story
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local processes to support its functionality. It launches a local Node.js dashboard server (
scripts/dashboard-server.mjs) and executes a Python script (scripts/author_memory_commit.py) to manage author preferences. These are bundled internal scripts and operate within the user's workspace context. - [EXTERNAL_DOWNLOADS]: The skill includes a version check feature that retrieves release information from the official GitHub repository (
zenstory-ai/oh-story-claudecode). It offers users the ability to update vianpx, which is a standard distribution method for this vendor's tools. - [INDIRECT_PROMPT_INJECTION]: The skill reads local novel project files, such as outlines and character settings, to perform analysis and search tasks. This establishes an ingestion surface for indirect prompt injection; however, because the data source is the user's own local creative work rather than untrusted external content, the risk is minimal and falls within normal operational parameters.
- [DATA_EXPOSURE]: The skill manages metadata and novel content within the
.story/directory and project folders. It does not access sensitive system credentials or private configuration files outside of its documented novel-writing scope.
Audit Metadata