novel-free

What to check before installing/using: - Inspect the shell scripts (scripts/*.sh and create-novel.sh, novel-free-launch.sh, init-project.sh) before running them. Look for network calls (curl/wget/nc/ssh/git remote operations), eval/exec of untrusted content, or commands that modify system files. If you are not comfortable, open the scripts in a text editor and confirm they only create/modify files under a project directory. - Review your openclaw.json (especially ~/.openclaw/openclaw.json, ./openclaw.json, /etc/openclaw/openclaw.json) to see what it contains. If it contains secrets or provider API keys, consider moving them or using a minimal config copy for testing. The skill reads these files to enumerate available models; that is coherent but may expose config content to the skill logic. - Do not run the included scripts as an automated agent with unrestricted permissions until you have verified their contents. Prefer running them manually in a sandbox or disposable environment (container, VM) the first time. - The SKILL.md claims it filters obvious credential fields (apiKey, token, secret, password) before embedding prompts; treat that as an assurance but not proof. If you store API keys in openclaw.json or elsewhere, consider removing them prior to first run or using least-privilege/test keys. - If you plan to use 'external directory' behavior, choose a project path you control (not system directories), and verify the scripts' write/read paths. - If you want higher assurance, request the vendor/author to provide a short audited changelog or a human-readable summary of what each script does; alternatively run the scripts with dry-run/echo mode if present. Reasoning summary: The skill appears functionally coherent with its stated purpose, but it exercises filesystem and local config reads and ships runnable scripts — these are legitimate for initialization and model mapping but create a modest risk if executed without review. Proceed after the checks above or run in a sandbox.