story-setup
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python and Node.js scripts, such as
merge-claude-settings.pyandstory_hook_cli.js, to manage configuration merging and project state monitoring. These operations are performed as part of the intended setup process and operate within the scope of the writing project. - [EXTERNAL_DOWNLOADS]: Fetches current version and release metadata from the author's official GitHub repository to provide update notifications. This network activity is limited to version checking and does not involve downloading executable scripts from untrusted remote servers.
- [SAFE]: Deployment logic incorporates a robust safety pre-check (
copy-path-safety.py) to prevent path traversal and directory nesting issues during file copying, ensuring that project files do not escape the designated workspace root. - [SAFE]: The skill follows secure credential management practices by requesting API keys via environment variables instead of hardcoding them. Additionally, it provides transparent instructions for users to review and manually enable platform-specific hooks in their respective IDE environments (e.g., TraeCode or Codex).
Audit Metadata