sf-novel-writer

分阶段支持科幻（Science Fiction）小说策划、写作与润色的技能。 触发条件: "想写科幻小说"、"想创作科幻作品"、"帮我构建科幻世界观"、 "继续写科幻小说"、"设计科幻情节"、"润色科幻小说"等， 涵盖一切与科幻小说创作相关的请求。支持短篇、中篇、长篇全类型。 覆盖硬科幻、太空歌剧、反乌托邦、赛博...

This skill appears coherent for scaffolding and guiding SF novel writing. Before installing: (1) inspect SKILL.md and README for any invisible/control characters (the scanner flagged unicode-control-chars) and remove or ask the author about them; (2) confirm you trust the author/owner (the source is 'unknown' and README references an external GitHub release—avoid downloading zips from untrusted origins); (3) be aware the included script will create files and a chapters/ directory under /home/claude/<project> — run it in a sandbox or with a project name you control if you have concerns; (4) verify the referenced /mnt/skills/public/docx/SKILL.md path exists and is what you expect if you plan to generate .docx outputs; (5) the skill does not request credentials or perform network activity itself, but if you follow README steps to download/install manually, treat those external downloads with the usual caution.

Type: OpenClaw Skill Name: sf-novel-writer Version: 1.0.0 The skill bundle provides a comprehensive workflow for science fiction novel creation and appears functionally aligned with its stated purpose. However, the script `scripts/init_project.py` contains a path traversal vulnerability because it uses the project name argument directly to construct file paths (e.g., `/home/claude/{name}`) without sanitization. This could allow an attacker to use prompt injection to trick the agent into creating directories or overwriting files outside the intended project folder. While likely an unintentional design flaw rather than malicious intent, it meets the criteria for a suspicious vulnerability.