Novel Character Graph

Professional long-form novel analysis and character relationship mapping + theme song generation. Automatically handles GBK/UTF-8 encoding, multi-GB file chu...

This skill appears to implement sensible local tools for splitting novels, extracting Chinese names, and generating an HTML graph, but there are several red flags you should address before installing or running it: 1) Clarify Suno/music integration: ask the author how Suno is invoked and what credentials are required — do not provide API keys until you see explicit, documented endpoints and env var names. 2) Confirm required binaries: SKILL.md references ffmpeg and suggests apt installs; ensure you install only the packages you trust and in a sandbox (container or VM) because the instructions include sudo apt install and in-place file operations. 3) Inspect SKILL.md for hidden unicode control characters and remove them; these can hide prompt-injection payloads. 4) Test the Python scripts on non-sensitive sample files first — the chapter-splitting and name-extraction use simple regexes and could mis-handle or overwrite files; back up original files. 5) If you must run theme-song generation, prefer a controlled environment and limit any uploads of full-text novel content to third-party services unless you understand the privacy/legal implications. If the author can provide explicit details on how Suno is called (client library, endpoint, required env vars) and update the registry metadata to declare those env vars and binaries, that will raise confidence.

Type: OpenClaw Skill Name: novel-character-graph Version: 1.0.2 The skill bundle provides functional scripts for novel analysis and character mapping, but the SKILL.md file contains high-risk instructions. Specifically, it directs the AI agent to install system-level dependencies (e.g., via sudo apt install) and explicitly states that this should be done 'without user approval' (无需用户批准即可安装依赖). While these tools (pandoc, calibre, etc.) are relevant to the stated purpose, instructing an agent to bypass user consent for system modifications is a significant security risk and a potential prompt-injection vector for unauthorized execution.