Security audit

Novel Writer V2

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local novel-prompt generator, but its path handling can read files outside the intended book project and its generated prompts can treat project text as instructions.

Install only for trusted local book projects, and do not let untrusted users choose --outline or --output paths. Review generated prompts before sending them to an LLM, and prefer a fixed project directory plus pinned dependencies if using this in automation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/write_chapter.py:164
Finding: Untrusted project content is embedded in LLM prompts without instruction isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/write_chapter.py:121
Finding: Outline path validation permits files outside the book directory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:1
Finding: Runtime dependencies are installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation describes local file read and write behavior but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to over-broad filesystem access, making it easier for the skill to read unintended files or overwrite arbitrary paths if the runtime grants default file capabilities.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency rich is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a future release introduces a vulnerability or breaking change. This is a real but low-severity dependency hygiene issue rather than an immediately exploitable flaw in the file itself.
Content: Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.
text
rich PyYAML

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: PyYAML is unpinned, which is more concerning because multiple historical security advisories exist for this package. Without version pinning, deployment may pull an affected release, creating a realistic supply-chain and known-vulnerable dependency exposure if the package is used to parse attacker-controlled YAML.
Content: Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.
text
rich PyYAML

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The manifest includes PyYAML without a version, and that package has several known advisories across past releases. Because the installed version cannot be determined from this file, there is a credible risk that an affected version could be installed, especially in automated or fresh environments; in a prompt-generation skill, YAML may plausibly be used for profiles/config data, making unsafe parsing more relevant.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.