T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cli.py:10- Finding
Path Traversal in Dynamic Script Dispatch Enables Local Python Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Novel Writer
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local novel-writing tool, but its command launcher can be abused to run unintended local Python files.
Review before installing. Use only documented CLI aliases, avoid arbitrary command names or --scripts values, run it in a dedicated project/virtual environment, and pin optional dependencies such as jieba before installation. Expect it to read manuscript files and create local reports, backups, config, and cache files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:95- Finding
Unpinned Optional Dependency Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (91)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The manifest explicitly documents caching, file hashing, change scanning, SQLite state, and parallel script infrastructure, all of which are operational behaviors beyond a simple writing assistant. Because these capabilities interact with the local filesystem and persistent state, presenting the skill primarily as a novel-writing engine understates its automation footprint and can lead to over-trust and unintended execution.
- Content
Static analysis
No suspicious patterns detected.