story-setup

Warn

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: MEDIUMPROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Instructions within sub-agent templates, specifically in references/templates/agents/chapter-extractor.md and references/opencode/agents/chapter-extractor.md, explicitly direct the AI to ignore content safety guidelines regarding violence or ethics, framing them as necessary for literary analysis and preventing the model from refusing to process sections of text.\n- [PERSISTENCE]: The skill implements a robust persistence mechanism by installing Git pre-commit hooks and configuring multiple platform-specific hooks (SessionStart, PreToolUse, Stop, PostCompact) in Claude Code, OpenCode, Codex, and others. These hooks are set up during the deployment phase and automatically execute scripts provided with the skill whenever the relevant project events occur.\n- [COMMAND_EXECUTION]: During the setup phase described in SKILL.md, the skill executes shell commands to modify file system permissions (chmod +x) for its deployed hook scripts and utilizes Python's subprocess module via scripts like scripts/deploy-antigravity-skills.py to manage file deployment and system interrogation.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external, untrusted text (user-provided novels). Sub-agents such as the chapter-extractor and narrative-writer process this content, creating a significant ingestion surface where malicious instructions embedded in the analyzed data could potentially influence the agent's behavior or bypass its logic.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 9, 2026, 06:08 PM
Security Audit — agent-trust-hub — story-setup