story-long-write
Warn
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute bundled Node.js scripts including
scripts/check-ai-patterns.js,scripts/normalize-punctuation.js, andscripts/check-degeneration.jsto validate and modify generated story files. Additionally, it utilizes Python shell commands to calculate precise character counts during the validation phase. - [EXTERNAL_DOWNLOADS]: The skill references an external repository (
https://github.com/worldwonderer/oh-story-claudecode) in its metadata as its source. It also involves managing and importing story assets from directories such as拆文库/, which serves as a data source for competitive analysis and benchmarking. - [PROMPT_INJECTION]: The skill ingests untrusted data from external files such as
选题决策.mdand reference assets in the拆文库/directory. Due to the lack of explicit boundary markers for this external content and the agent's significant capabilities (file writing and script execution), there is a risk of indirect prompt injection where instructions embedded in these processed files could influence agent behavior.
Audit Metadata