story-setup
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill configures and deploys local hooks (
run-story-hook.sh,run-story-hook.cmd, andstory_codex_hook.py) that are executed during various agent lifecycle events (e.g., project startup, before using tools, and at the end of a session). These scripts are used for environment setup and project context management. - [COMMAND_EXECUTION]: The
story_codex_hook.pyscript usessubprocess.check_outputto executegitcommands (git rev-parse --show-toplevel,git diff) andcygpathto resolve project paths and identify modified files for content validation. This is a standard practice for project-aware tools. - [DATA_EXFILTRATION]: The skill performs read operations on local project files such as
.active-book,_tracking-state.json, and chapter files to maintain a writing context. This data is processed locally within the agent's environment and no evidence of exfiltration to external domains was found. - [REMOTE_CODE_EXECUTION]: No remote code execution patterns, external package installations, or remote script downloads were detected. All executable components are bundled within the skill repository.
Audit Metadata