Story Writer

小说创作、角色设计、情节设计(三幕式)、对话生成、世界观构建、续写。Story writing with character design, three-act plot structure, dialogue generation, worldbuilding. Supports bilingual docum...

This skill appears to be a local story-writing toolkit implemented as bash scripts. It does not contact the network or request credentials, which is good. Before installing or running it: 1) Note that it will create and write files under ~/.local/share/story-writer (or $XDG_DATA_HOME or $STORY_DIR if set); if you want to avoid that, set STORY_DIR to a safe folder. 2) The SKILL.md incorrectly lists python3 as a requirement — the scripts are bash-based, so python isn't needed. 3) The scripts write files using user-supplied names (e.g., save <name>), which could allow path traversal if names are not sanitized — avoid passing untrusted or specially crafted names and review the cmd_save implementation. 4) Review the provided scripts yourself (or run them in a sandbox/container) before giving the agent permission to execute them. If you plan to let the agent run the skill autonomously, remember it will be able to write files to your user data directory, so limit privileges accordingly.

Type: OpenClaw Skill Name: story-writer Version: 2.0.2 The skill bundle is a legitimate toolkit for story writing and character design, providing bash scripts (script.sh and story.sh) that generate creative templates and manage local story drafts. While script.sh contains a minor path traversal vulnerability in its save command, the risk is mitigated by a forced .md extension and appears to be an unintentional coding flaw rather than a malicious feature. No evidence of data exfiltration, unauthorized network access, or malicious prompt injection was found across the files.