story-setup

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill configures and deploys local hooks (run-story-hook.sh, run-story-hook.cmd, and story_codex_hook.py) that are executed during various agent lifecycle events (e.g., project startup, before using tools, and at the end of a session). These scripts are used for environment setup and project context management.
  • [COMMAND_EXECUTION]: The story_codex_hook.py script uses subprocess.check_output to execute git commands (git rev-parse --show-toplevel, git diff) and cygpath to resolve project paths and identify modified files for content validation. This is a standard practice for project-aware tools.
  • [DATA_EXFILTRATION]: The skill performs read operations on local project files such as .active-book, _tracking-state.json, and chapter files to maintain a writing context. This data is processed locally within the agent's environment and no evidence of exfiltration to external domains was found.
  • [REMOTE_CODE_EXECUTION]: No remote code execution patterns, external package installations, or remote script downloads were detected. All executable components are bundled within the skill repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 02:20 AM