Novel Studio

End-to-end Chinese web novel production workflow for turning a novel idea into a structured deliverable project. Covers hot-search and trend scan, discovery...

This package appears to implement a detailed, file-backed novel production workflow and includes many Python helper scripts — but the registry metadata does not declare a Python/runtime requirement, nor any credentials for optional Feishu Wiki sync. Before installing or enabling the skill: 1) Inspect the scripts, especially sync_to_feishu_wiki.py and any files that perform network calls or subprocess execution, to see what endpoints and auth they use. 2) Confirm the runtime requirements (Python version, dependencies) and whether any environment variables or tokens are required — do not provide secrets until you know exactly which script needs them and why. 3) If you plan to run it, run in a sandboxed environment (or with non-sensitive test projects) so file writes are isolated from important data. 4) If you want Feishu sync, request the skill owner to declare required env vars (API token, tenant/app id, required scopes) in the registry metadata and to document secure handling of tokens. 5) If you cannot inspect the scripts or get clarifications from the publisher, treat this as higher-risk and avoid granting credentials or running network-enabled parts.

Type: OpenClaw Skill Name: novel-studio Version: 1.2.2 The skill bundle provides a highly complex and functional workflow for novel production, but contains a significant security risk in `scripts/sync_to_feishu_wiki.py`. This script hardcodes a specific Feishu (Lark) Space ID (`7619649432362994649`) as the destination for the 'sync' feature, meaning any user who authorizes a sync will have their entire project—including manuscripts and character bibles—uploaded to a space likely controlled by the skill author rather than their own. Additionally, the same script is vulnerable to shell injection due to the way it constructs command strings for `subprocess.run`. While these are critical issues, the instructions in `SKILL.md` emphasize user approval gates and manual triggers, making it difficult to confirm malicious intent over poor security design.