webnovel-init

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to perform project initialization and management. It executes Python scripts such as webnovel.py, reference_search.py, and init_project.py located within the plugin's scripts directory. These commands handle state management, project creation, and metadata generation based on user-provided inputs.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes WebSearch and WebFetch tools to retrieve market trends, platform-specific guidelines, and other time-sensitive data from external websites. This is intended to provide authors with current industry context.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its capability to ingest untrusted data from the internet via WebFetch and from local project files. This data is subsequently used to influence the agent's creative generation and the parameters passed to local execution scripts.
  • Ingestion points: Data retrieved from external domains via WebSearch and WebFetch, as well as existing project files like README.md.
  • Boundary markers: The instructions do not define specific delimiters or security warnings to prevent the agent from following instructions embedded in retrieved content.
  • Capability inventory: The agent can execute shell commands (Bash), write to the filesystem (Write, Edit), and perform network requests (WebFetch).
  • Sanitization: The skill includes instructions to sanitize the project_root string by removing illegal characters, but does not specify sanitization or validation logic for data fetched from external sources before it is processed or used in script arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 11:45 AM