story-setup
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMPROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Instructions within sub-agent templates, specifically in
references/templates/agents/chapter-extractor.mdandreferences/opencode/agents/chapter-extractor.md, explicitly direct the AI to ignore content safety guidelines regarding violence or ethics, framing them as necessary for literary analysis and preventing the model from refusing to process sections of text.\n- [PERSISTENCE]: The skill implements a robust persistence mechanism by installing Gitpre-commithooks and configuring multiple platform-specific hooks (SessionStart, PreToolUse, Stop, PostCompact) in Claude Code, OpenCode, Codex, and others. These hooks are set up during the deployment phase and automatically execute scripts provided with the skill whenever the relevant project events occur.\n- [COMMAND_EXECUTION]: During the setup phase described inSKILL.md, the skill executes shell commands to modify file system permissions (chmod +x) for its deployed hook scripts and utilizes Python'ssubprocessmodule via scripts likescripts/deploy-antigravity-skills.pyto manage file deployment and system interrogation.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external, untrusted text (user-provided novels). Sub-agents such as thechapter-extractorandnarrative-writerprocess this content, creating a significant ingestion surface where malicious instructions embedded in the analyzed data could potentially influence the agent's behavior or bypass its logic.
Audit Metadata