story-publish

This module itself does not show direct malicious logic, obfuscation, or explicit data exfiltration. However, it functions as a high-privilege execution harness for externally provided adapter scripts and relies on weak, text-based gating (keywords in adapter --help) rather than verifiable runtime enforcement. Because adapter paths and interpreter locations are taken from CLI/config and executed without integrity checking or sandboxing, the overall supply-chain security risk is meaningful: a malicious or tampered adapter (or modified .story-publish.json) could lead to harmful actions under the caller’s privileges.