Quality Checker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 1.0.2

Overview

This skill is a local chapter-quality checker with ordinary file input and optional report output, though it has unpinned Python dependencies and a Chinese-only interface.

Install in a virtual environment and consider pinning rich and PyYAML before use. Expect Chinese-language help and report output, and only pass chapter/config/report paths you intend the tool to read or write.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt, lines 1-2
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text

rich
PyYAML

The installation of this file is documented in SKILL.md, lines 115-119:

bash

pip install -r scripts/requirements.txt

Technical Analysis

Both third-party dependencies are specified without exact versions or integrity hashes. As a result, each installation resolves whichever compatible releases are available from pip's configured package index at that time.

This makes installations non-reproducible and prevents verification that users receive dependency artifacts reviewed by the project maintainers. If a dependency release or configured package source is compromised, the installation may introduce attacker-controlled package code. The application subsequently imports both dependencies:

python

import yaml
from rich.console import Console
from rich.table import Table
from rich.text import Text

Malicious package code could therefore execute during package installation or when the application imports the affected module.

Attack Path

1. An attacker compromises a dependency release, its distribution account, or a package source configured for pip.
2. The attacker publishes or serves a malicious version of rich or PyYAML.
3. A user follows the documented installation command:

   bash

   pip install -r scripts/requirements.txt
   

4. Because no version or artifact hash is enforced, pip resolves and installs the attacker-controlled release.
5. Malicious code executes during installation or when check_quality.py imports the package.
6. The payload operates with the privileges of the user or automation account running pip or the quality checker.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing or executing account. The resulting access is limited by that account's op ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an explicitly reviewed version:

   text

   rich==<reviewed-version>
   PyYAML==<reviewed-version>
   

2. Generate and verify cryptographic hashes for all packages and transitive dependencies, then install with:

   bash

   pip install --require-hashes -r scripts/requirements.txt
   

3. Use a lock-file workflow such as pip-tools to capture exact transitive dependency versions.
4. Configure pip to use a trusted package index or an internally controlled dependency mirror.
5. Add automated dependency vulnerability scanning and periodic review of proposed upgrades.
6. Perform installations in an isolated virtual environment with the minimum required privileges; never install project dependencies as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description and usage scenarios say the skill should be used whenever someone needs to assess chapter quality or find writing problems, but they do not define specific trigger phrases, scope boundaries, or exclusion conditions. This makes invocation criteria ambiguous and could cause the skill to be selected for generic editing or review requests beyond its intended niche.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings and documentation entirely in Chinese, and later CLI descriptions, warnings, and output are also fixed to Chinese. Because the skill does not offer a language selection or document a justified locale restriction, it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script prints warnings, errors, argument help text, and generated report content in Chinese only. This forces a specific language on all users and there is no visible mechanism to choose another locale or to opt in to the Chinese-only experience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description and the entire user-facing documentation are presented in Chinese, which can impose a language choice on users without documenting that constraint or offering alternatives. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue unless the constraint is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This YAML file uses Chinese-only natural-language labels and comments such as '配置文件' and '目标字数', which indicates a fixed language choice in the skill's human-facing configuration context. The file does not mention any user opt-in, language selection, or a documented region-specific justification for requiring Chinese.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency 'rich' is unpinned, which makes builds non-reproducible and allows future installs to pull in unexpected versions. While this is primarily a supply-chain hygiene issue rather than an immediate exploit, it can expose the skill to vulnerable or breaking upstream releases over time.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

rich
PyYAML

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency 'PyYAML' is unpinned, which is more concerning because this package has a history of security advisories. Without version pinning, deployments may install an affected release, increasing the risk if the code processes attacker-controlled YAML or uses unsafe loading paths.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

rich
PyYAML

Unverifiable Dependency: PyYAML has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyYAML has multiple known advisories, and because no version is specified, there is no way to verify whether the installed dependency is vulnerable. In a skill that may process user-supplied or external content, this uncertainty increases supply-chain and deserialization risk, especially if YAML parsing is used anywhere in the implementation.

Content

No source excerpt is available for this finding.