The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several internal Node.js and Python scripts (e.g., normalize-punctuation.js, check-ai-patterns.js, check-degeneration.js, author_memory_commit.py, tracking_commit.py) via the shell to perform quality linting and state management. While these scripts are part of the skill's package and perform legitimate analysis, they represent a significant local execution capability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-controlled content (manuscripts) and interpolates this data into sub-agent prompts, creating a potential path for adversarial instructions to influence the agent.
Ingestion points: Manuscript files are read from the project's 正文/ (body), 设定/ (setting), and 大纲/ (outline) directories in SKILL.md Phase 1.
Boundary markers: Prompt templates for sub-agents (e.g., story-architect, character-designer) use placeholders like {审查范围：{文件路径/章节/必要摘录}} without explicit delimiters or instructions to ignore embedded commands, relying on standard instructional language instead.
Capability inventory: The skill can execute local shell commands (Node.js/Python scripts), write to project state files (.story-review/state.md, 追踪/), and spawn multiple sub-agents.
Sanitization: No explicit sanitization or filtering of the manuscript content is described before it is injected into the sub-agent contexts.

story-review