novel-characters

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes its own Node.js script to perform text chunking, data merging, and report rendering. These shell operations are strictly limited to local file processing and do not involve untrusted commands. Evidence: CLI commands in SKILL.md such as node scripts/novel-characters.mjs chunk and render.
  • [SAFE]: The skill implements strong output validation to prevent data corruption or model hallucinations. Evidence: The validateCast function in scripts/novel-characters.mjs performs deterministic checks on structure, enum values, and ensures that evidence quotes are verbatim copies of the source text.
  • [SAFE]: The rendering logic includes built-in XSS protection for generated HTML reports. Evidence: The esc and marked functions in scripts/novel-characters.mjs escape all character data and stories summaries before embedding them into the report template.
  • [SAFE]: The skill is designed to be self-contained and avoids all external network requests or third-party package dependencies. Evidence: The scripts/novel-characters.mjs file uses only Node.js standard library modules (node:fs, node:path, node:url) and explicitly targets local platform binaries like codex.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 11:40 AM
Security Audit — agent-trust-hub — novel-characters