skills/agentskillexchange/skills/Write long-form fiction with agent skills using Oh Story/Gen Agent Trust Hub
Write long-form fiction with agent skills using Oh Story
Warn
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install third-party code from an external repository ('zenstory-ai/oh-story-claudecode') using the 'npx skills add' command. This repository is not associated with a recognized trusted vendor or organization.
- [METADATA_POISONING]: The skill metadata contains unverifiable trust signals, including a claim that it has been 'security_reviewed' and an unvalidated GitHub star count of 7087. These metrics are used to imply a level of safety and popularity that cannot be independently confirmed from the skill content.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external fiction content, outlines, and story state files, which presents an attack surface for indirect prompt injection. Malicious instructions embedded in narrative text could potentially be executed by the agent.
- Ingestion points: Fiction project files, story state files, and outlines (SKILL.md).
- Boundary markers: No delimiters or instructions are provided to the agent to ignore embedded commands in the story content.
- Capability inventory: The skill is capable of managing story state and modifying project files through the setup and drafting workflow.
- Sanitization: No sanitization or filtering of user-provided story content is specified.
Audit Metadata