fanqie-novel-publisher

• Outcome: Review
• Latest audit: Aug 14, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Fanqie chapter publishing tool, but it can directly publish or bulk-save account content while storing login cookies locally and using under-disclosed clipboard and browser automation behavior.

Review carefully before installing. Use it only for an account where you are comfortable with automated browser control, local cookie storage, and manuscript text being placed on the system clipboard. Prefer draft mode, verify the selected work and chapter list before running, and clear saved cookies with logout when finished.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif system == "Windows":
                # Windows 使用 clip 命令，需要 utf-16le 编码
                proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
                proc.communicate(text.encode('utf-16le'))
                return True

• Confidence: 96% confidence
• Finding: The Windows clipboard path uses `subprocess.Popen(..., shell=True)`, which unnecessarily routes execution through the shell. Even though the command is currently hardcoded as `clip`, shell execution expands the attack surface and can be influenced by environment or shell-resolution behavior, adding host command execution capability to a publishing skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and demonstrates file access, shell execution, browser automation, and networked publishing behavior, but does not declare any permissions or safety boundaries. This creates a transparency and authorization gap: users or orchestrators may invoke a skill that can read local chapter files and perform live account actions without an explicit permission contract.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The browser context is configured to evade automation detection by disabling automation-related Chromium indicators and redefining navigator.webdriver. For a chapter publishing tool, these stealth measures are not necessary for core functionality and can facilitate deceptive interaction with the platform, increasing the risk of violating platform protections or being repurposed for abusive automation.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The module copies full chapter contents into the system clipboard via OS utilities, which exposes sensitive or proprietary manuscript text outside the browser automation boundary. Any local process, clipboard history tool, remote desktop integration, or later user paste action may leak that content, making this broader than the stated purpose of publishing a chapter.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad publishing-related terms such as '发布章节' and '存入草稿箱', which can match ordinary user requests and cause the skill to activate in contexts where the user did not intend account automation. Because this skill performs real actions against a writer backend, accidental invocation could lead to unwanted logins, draft creation, or publication attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill description explains how to publish, save drafts, and log into the Fanqie writer backend, but it does not clearly warn that it will perform direct, state-changing actions on the user's account. In this context, missing disclosure is more dangerous because the skill is designed for live content operations, so a user may not appreciate that invocation can immediately affect production content and account state.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code persists authentication cookies to a local JSON file without encryption, access controls, expiry handling, or any explicit user warning. If the file is read by another local user, process, or malware, the session can be replayed to access the author's publishing account and perform unauthorized actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill can directly publish chapters or save drafts once invoked, without a final user confirmation at the irreversible action point. In an agent setting, this increases the risk of accidental publication of wrong, incomplete, or sensitive content if upstream prompts or parameters are mistaken or manipulated.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

elif system == "Windows":
                # Windows 使用 clip 命令，需要 utf-16le 编码
                proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
                proc.communicate(text.encode('utf-16le'))
                return True

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same risky behavior: shell-enabled process creation for clipboard operations. The danger is not immediate user-input injection in the current code, but the unnecessary shell mediation materially weakens the security posture of an automation skill running on the host.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

elif system == "Windows":
                # Windows 使用 clip 命令，需要 utf-16le 编码
                proc = subprocess.Popen(['clip'], stdin=subprocess.PIPE, shell=True)
                proc.communicate(text.encode('utf-16le'))
                return True

• Confidence: 97% confidence
• Finding: This duplicate finding points to the same risky behavior: shell-enabled process creation for clipboard operations. The danger is not immediate user-input injection in the current code, but the unnecessary shell mediation materially weakens the security posture of an automation skill running on the host.

Static analysis

No suspicious patterns detected.