story-short-write
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple locally provided utility scripts for content validation and state management. These include Python scripts (
author_memory_commit.py) for maintaining author preferences and Node.js scripts (e.g.,check-ai-patterns.js,check-degeneration.js,check-delivery-contract.js) for analyzing story quality and formatting. These operations are strictly local and consistent with the skill's creative purpose. - [INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted data in the form of user-generated story text. It defines a vulnerability surface by analyzing this text via scripts to influence the agent's feedback loop. This risk is mitigated by the use of defined structural markers (e.g.,
###1.) and specific validation logic that treats story content as data rather than instructions.
Audit Metadata