webnovel-init
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform project initialization and management. It executes Python scripts such aswebnovel.py,reference_search.py, andinit_project.pylocated within the plugin's scripts directory. These commands handle state management, project creation, and metadata generation based on user-provided inputs. - [EXTERNAL_DOWNLOADS]: The skill utilizes
WebSearchandWebFetchtools to retrieve market trends, platform-specific guidelines, and other time-sensitive data from external websites. This is intended to provide authors with current industry context. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its capability to ingest untrusted data from the internet via
WebFetchand from local project files. This data is subsequently used to influence the agent's creative generation and the parameters passed to local execution scripts. - Ingestion points: Data retrieved from external domains via
WebSearchandWebFetch, as well as existing project files likeREADME.md. - Boundary markers: The instructions do not define specific delimiters or security warnings to prevent the agent from following instructions embedded in retrieved content.
- Capability inventory: The agent can execute shell commands (
Bash), write to the filesystem (Write,Edit), and perform network requests (WebFetch). - Sanitization: The skill includes instructions to sanitize the
project_rootstring by removing illegal characters, but does not specify sanitization or validation logic for data fetched from external sources before it is processed or used in script arguments.
Audit Metadata