Shorts Builder

Story generation pipeline skill. Supports multi-episode continuous generation, graph management, AI quality check + human confirmation dual control mechanism...

This package generally implements a local story-generation pipeline and is not obviously malicious, but there are several mismatches you should review before installing: - Naming and manifest mismatches: the registry name ('Shorts Builder') and the SKILL.md/internal module name differ; the registry says "instruction-only" but the package contains runnable Python code. Treat this as a signal to verify origin. - Docs vs code inconsistencies: SKILL.md mentions a remote Graph API and a 3-retry limit for AI review, but the code uses local JSON files for graph storage and allows unlimited AI retries. If you rely on the 3-retry limit or remote storage, update/verify the implementation. - Data persistence: generated content and all pipeline state are written to data/pipeline_state.json and data/graphs/*.json. These files may contain any text you or users include. If that is sensitive, run the skill in an isolated environment or configure storage/retention policies. - Exposure to LLM provider: the AI-review prompts include full episode content and graph data — the agent will send those to whichever LLM it uses. If you have confidentiality concerns, avoid sending private data or run using a private model. Recommendations before enabling/installing: - Inspect the code locally (you already have it) and search for any network calls (requests, socket, urllib, etc.). The provided files show no obvious remote HTTP calls, but double-check for dynamically imported modules or later changes. - Run the skill in a sandboxed agent or VM to observe file writes and outbound network activity. - If you need the 3-retry limit or remote graph storage, update the pipeline.py/graph_manager implementations accordingly. - If you are concerned about persistent storage of story content, either relocate data/ to an encrypted or temporary directory or add a data-retention/auto-delete feature. If you want, I can produce a short checklist or specific code edits to enforce a retry limit, disable disk persistence, or log all outbound requests for safer operation.

Type: OpenClaw Skill Name: shorts-builder Version: 1.0.1 The skill bundle implements a comprehensive story generation pipeline including state persistence, character tracking, and a dual-stage (AI and human) review process. While the documentation in SKILL.md contains minor inaccuracies—claiming the use of remote APIs and network connectivity for graph management—the actual implementation in graph_manager.py and pipeline.py uses local JSON files for storage. No evidence of data exfiltration, malicious execution, or prompt injection attacks was found; the code logic is consistent with the stated purpose of managing creative writing workflows.