novel-free
Analysis
The skill mostly matches its novel-writing purpose, but it reads local OpenClaw model/account configuration and sends project content to spawned model agents, so it should be reviewed before use.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
`./novel-free-launch.sh`; `./create-novel.sh <项目名>`; `./scripts/simple-auto-configure.sh /path/to/project`; `./scripts/error-handler.sh backup <项目目录>`
The skill asks the user to run local shell scripts that create and manage projects, update configuration, and perform backups. This is central to the skill's stated automation purpose and is user-directed.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
`openclaw.json` 读取优先级：`~/.openclaw/openclaw.json` → `./openclaw.json` → `/etc/openclaw/openclaw.json`; 嵌入子 Agent prompt 前过滤凭据字段（`apiKey`、`token`、`secret`、`password`）
The skill explicitly reads local OpenClaw configuration from user, project, and system locations and acknowledges credential-like fields may be present. This is not declared in the registry requirements as a required config path or credential.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
`sessions_spawn({ task: `${read("references/agent-main-writer.md")} ... ${read("worldbuilding/world.md")} ... ${read("characters/protagonist.md")} ... ${read("outline/outline.md")}`, model: readConfig("meta/config.md", "mainWriter"), mode: "run" })`The workflow sends project documents to spawned model-agent sessions. This is disclosed and purpose-aligned for multi-agent writing, but it is a data boundary users should notice.
`fixed-context.md 强制写入规范` ... `Phase 2 写作期间，Coordinator 的固定层输入只读 references/fixed-context.md` ... `resumeRequired = true 恢复时（会话重启后全量刷新）`
The skill stores compressed context and reuses it across chapter generation and session recovery. This persistence is expected for long novel continuity, but cached content can steer later outputs.