Security audit

Novel Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill supports novel-writing workflows, but it also includes under-disclosed host-profile reading, external search, self-evolution, and broad maintenance/publishing tooling.

Install only if you are comfortable with a writing skill reading project files and possibly WorkBuddy profile/memory data, writing persistent project state, and using external search. Avoid using it on confidential manuscripts unless network search and host-profile import are disabled or reviewed, and treat the bundled maintenance, publishing, and self-evolution scripts as requiring explicit manual review before use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/workbuddy-user-profile-bridge.mjs:27
Finding: Automatic Access to Host Identity and Persistent Memory Files
Content: View full analysis
{ parseMemeryFiles(source.dir, source.files, profile); }); profile.isProfileComplete = checkProfileCompleteness(profile); return profile; } ``` The normal intake route invokes the collector automatically: ```js function buildProfileContext(hostCap) { const workbuddyHome = hostCap?.workbuddy?.homeDir; if (!workbuddyHome || hostCap?.hostType != ...[truncated 2545 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/intake-router.mjs:311
Finding: Cross-Workspace Filesystem Reconnaissance Across Mounted Windows Drives
Content: View full analysis
= maxResults) return out; } let lv2 = []; try { lv2 = fs.readdirSync(p1, { withFileTypes: true }); } catch { continue; } for (const d2 of lv2) { if (!d2.isDirectory()) continue; const p2 = path.join(p1, d2.name); if (fs.existsSync(path.join(p2, '.fbs', 'chapter-status.md')) || fs.existsSync(path.join(p2, '.fbs', 'workbuddy-resume.json'))) { out.push(path.resolve(p2)); if (out.length >= maxResults) return out; } ...[truncated 2038 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/knowledge-fetcher.mjs:89
Finding: User-Derived Task Text Is Transmitted to External Search Providers Without a Sensitivity Gate
Content: View full analysis
{ out.push({ query: `${t} ${suffixes[i % suffixes.length]}`, type: 'relative_time', priority: 2 }); }); return out; } ``` The resulting query is embedded into external GET URLs: ```js _buildEndpointCandidates(query, route) { const encodedQuery = encodeURIComponent(query.query || ''); const preferred = this.searchPolicy?.searchAccessPolicy?.effectiveEndpointStrategy?.preferredEndpoints || []; const resolved = []; preferred.forEach((cfg) => { if (cfg.rssEndpoint_USE_THIS) { resolved.push({ type: 'bing_rss', name: `${cfg.engine || 'bing'}_rss`, url: this._renderEndpointUrl(cfg.rssEndpoint_USE_THIS, encodedQuery) }); } else if (cfg.rssEndpoint) { resolved.push({ type: 'bing_rss', name: `${cfg.engine || 'rss'}_rss`, url: this._renderEndpointUrl(cfg.rssEndpoint, encodedQuery) }); } ...[truncated 3235 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/publish-clawhub.mjs:41
Finding: Unpinned Runtime Publishing Dependency and Shell Command Injection Surface
Content: View full analysis
`"${String(s).replace(/"/g, '\\"')}"`; const cmd = [ 'npx', 'clawhub@latest', 'publish', quote(pathArg), '--slug', 'fbs-bookwriter', '--name', quote('FBS-BookWriter'), '--version', quote(version), '--changelog', quote(changelog), '--tags', quote(tags), ].join(' '); execSync(cmd, { stdio: 'inherit', cwd: ROOT, shell: true }); ``` The package script exposes this path directly: ```json "publish:clawhub": "node scripts/publish-clawhub.mjs" ``` ### Technical Analysis The publishing script executes `npx clawhub@latest`, causing the effective third-party code to be selected at execution time rather than review time. The `latest` tag is mutable, so a future compromised or malicious release can execute with the invoking user's privileges. The script also constructs one shell command string and invokes it with `shell: true`. Environment-controlled `FBS_CLAWHUB_CHANGELOG` and `FBS_CLAWHUB_TAGS` values are inserted into that string. The custom `quote()` function only escapes double quotation marks and does not provide portable shell escaping. Shell metacharacter behavior differs between Windows command processors and POSIX shells. Characters such as command substitutions, variable expansions, percent expansions, delayed expansions, escape characters, and separators can retain special meaning inside or around quoted strings. Consequently, an att ...[truncated 1808 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (413)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The description embeds very broad trigger conditions such as general writing-related terms, making it likely this skill activates during ordinary conversations about writing. Because the skill can lead to shell/script execution and file manipulation, over-broad activation raises the chance of unexpected invocation and tool use outside the user's intent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
- **精修**：执行 `polish-gate.mjs` 质检后再改稿

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
- **精修**：执行 `polish-gate.mjs` 质检后再改稿

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
- 扩写前必须备份：`source-write-backup.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
- 扩写前必须备份：`source-write-backup.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
- 执行 `release-governor.mjs`（终稿唯一版本 + 归档）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
- 执行 `release-governor.mjs`（终稿唯一版本 + 归档）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
| 初始化项目 | `node scripts/intake-router.mjs --book-root "{bookRoot}" --intent auto --json --enforce-required` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
| 门禁检查 | `node scripts/s0-exit-gate.mjs --book-root "{bookRoot}" --json --confirm-advance` |

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Trigger section lists ambiguous everyday phrases like '写作', '继续写', and '这个情节怎么发展', without clear invocation boundaries. In context, this is more dangerous because activation can pull the agent into a workflow that reads/writes project files and executes local scripts, even when the user may only want generic writing help.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description embeds many broad trigger phrases such as 写作, 大纲, 章节, 写长文, and related generic terms that could activate the skill in routine conversations unrelated to this package's intended use. Because the skill appears to have a very large operational surface, overbroad activation raises the risk of unintended routing, exposure of tool capabilities, and execution of complex workflows in the wrong context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: cleanupTempDirectories() uses recursive directory deletion (fs.rmSync with recursive:true, force:true) across directories discovered under the project root based on broad name patterns such as temp and unzip. Because this capability is not needed for story generation and operates destructively over the filesystem tree, mistakes in naming, matching, or invocation can wipe substantial repository data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file exposes a self-evolution control surface that can modify the skill's capabilities, fetch new methodology, update modules, and alter configuration, which is materially outside the declared novel-writing workflow. In an agent-skill context, hidden self-modification significantly increases supply-chain and integrity risk because a writing skill can change behavior over time without clear user review or alignment to its manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The triggerEvolution path can initiate network-backed knowledge retrieval and capability updates, then invoke the evolution engine to change functionality. For a novel-writing skill, this creates an unexpected remote-influence path where external content can alter local behavior, increasing risk of malicious updates, prompt-surface expansion, or unauthorized code/config changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The rollback operation proceeds despite only pretending to prompt for user choice and confirmation. Because rollback can change active state in a self-evolving system, bypassing confirmation creates a high-integrity risk: an attacker or accidental trigger could revert the system to an unintended version without interactive approval.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a 'novel architect' skill for end-to-end爽文小说 writing, outlining, chapter generation, and quality control. This file instead implements a standalone semantic search/deep research tool with query expansion, source scoring, cross-verification, and research report generation, which is materially different from fiction-writing functionality rather than an obvious implementation detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill manifest describes a novel-writing workshop covering direction refinement, outlining, chapter generation, and quality control for fiction writing. This script instead performs simulated UX optimization, access-control checks, audit/alert reporting, and deployment-oriented quality summaries, which are unrelated to generating or managing novel content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file presents itself as part of a novel-writing skill, but its documented commands route to enterprise/ops functions such as contract preflight, WeCom scene-pack administration, credits ledger access, session exit persistence, and host capability detection. This mismatch is dangerous because it can give a writing-focused agent or user an unexpected administrative execution surface and increase the chance of invoking unrelated privileged workflows under false pretenses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The bridge exposes a generic subprocess dispatcher via spawnSync that launches multiple local scripts based on user-selected subcommands. In the context of a novel-writing skill, this creates an unnecessary host execution primitive that can trigger administrative scripts and expand the blast radius if the skill is invoked by a higher-privilege agent or integrated into automation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Publishing, release registry, marketplace packing, and release-feedback tooling are out of scope for a novel-writing workshop and materially increase the chance of supply-chain or exfiltration-style behavior. In context, these scripts could package workspace contents, publish artifacts, or move data to external destinations without a clear user need tied to drafting fiction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enterprise member verification, entitlement, credits, and admin scene-pack handling are unrelated to novel writing and suggest access to organizational identity or billing-style controls. In this skill context, such capabilities are especially suspicious because they could enable unauthorized account lookups, privilege misuse, or collection of enterprise/user metadata under the guise of a harmless writing workflow.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/init-fbs-multiagent-artifacts.mjs (reported line 118)May include surrounding context.
js
const CHAPTER_STATUS = `# 章节完成状态台账（多路并行 S3）

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/init-fbs-multiagent-artifacts.mjs (reported line 118)May include surrounding context.
js
const CHAPTER_STATUS = `# 章节完成状态台账(多路并行 S3)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Environment snapshot collection is not necessary to initialize memory for a fiction-writing project, so its presence indicates unjustified access to host and user context. The code also passes a --write flag and supports --no-redact, increasing the chance that sensitive machine, workspace, or user-probe data is persisted to disk without strong necessity.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 65% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/intake-router.mjs (reported line 1150)May include surrounding context.
js
strategy: 'dual-track', lowRisk: 'auto', highRisk: 'confirm', denyExamples: ['git reset --hard', 'rm -rf', 'del /f /s'], policyScript: 'scripts/command-approval-policy.mjs', }; const clarifyContracts = buildClarifyContracts();

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/audit-entry-performance.mjs:37

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/book-health-snapshot.mjs:52

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/delivery-chain.mjs:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/env-preflight.mjs:57

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fbs-cli-bridge.mjs:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fbs-doctor.mjs:25

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/init-project-memory.mjs:55

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/intake-router.mjs:118

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/launch-presentation-preview.mjs:187

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/channel-pack.mjs:283

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/git-workspace-changes.mjs:24

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/pack-skill-gates.mjs:150

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/midterm-execution-chain.mjs:61

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/polish-gate.mjs:259

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-clawhub.mjs:65

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/quality-audit-incremental.mjs:184

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/quality-panorama-orchestrator.mjs:342

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-p0-audits.mjs:82

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/s3-guard.mjs:84

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/s3-start-gate.mjs:142

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/smoke-pack-verify.mjs:14

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/standard-execution-chain.mjs:109