Security audit

Novel Chapter Review

Security checks for vulnerabilities and agentic risk

Overview

This Chinese novel-review skill is mostly coherent, but it directs agents to perform broad code-driven manuscript edits and memory-file synchronization without strong scoping or rollback safeguards.

Install only if you want an agent to review and potentially revise Chinese novel manuscripts. Before letting it edit, require an explicit chapter/file scope, ask for a proposed diff or dry run, and do not allow bulk Python edits or memory-file synchronization unless you have backups and have approved the exact target files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description lists trigger scenes as "审稿、改稿、质量复盘", which are common editorial activities rather than precise activation phrases or constrained contexts. This makes it unclear when the skill should activate versus when ordinary conversation about reviewing or revising writing should not invoke it.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill instructions and outputs are entirely in Chinese and implicitly require Chinese-language operation, but they do not state that language is optional or limited to a justified region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill claims to perform chapter-by-chapter review, but the workflow explicitly extends into executing manuscript modifications. This is a scope expansion from analysis into content transformation, which can cause unintended edits, overwrite user intent, and make a review-only skill perform destructive actions without a clearly bounded authorization step.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documentation directs bulk replacement and memory-file synchronization behavior, which goes beyond passive review and introduces repository-wide write operations. In an agent context, this can propagate mistaken changes across many chapters or auxiliary state files, amplifying damage from a bad review or prompt misunderstanding.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs use of execute_code and Python scripts for bulk editing, which is unnecessary for a chapter-review skill and materially increases execution risk. Code-driven mass edits can alter many files quickly, create silent corruption, and bypass the safer, reviewable patch-based workflow expected for textual editorial tasks.

Static analysis

No suspicious patterns detected.