Webnovel Serial Pipeline
v0.1.4Build and publish a Quartz-hosted Korean web-novel serial (draft→cover→webp→episode md→lint→publish). Uses Nano Banana Pro + ffmpeg.
⭐ 0· 1.1k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts and SKILL.md align with the described goal (build/publish a Quartz-hosted web-novel using local files and ffmpeg). However the registry metadata claims 'no required binaries' and 'no required env vars' while SKILL.md and scripts require python3, ffmpeg (checked by scripts/check_deps.sh) and the environment variable WEBNOVEL_QUARTZ_ROOT (required at runtime). This mismatch is a coherence issue in metadata vs actual behavior.
Instruction Scope
Runtime instructions and scripts operate on local files, run a linter, check for embedded assets, convert images using ffmpeg, and update a local Quartz vault. The SKILL.md explicitly requires human confirmation before publishing and the scripts do not perform network calls or read system-wide config files. The prepublish_check scans files in the skill directory to DETECT suspicious strings (not to fetch them); this behavior is documented in the README.
Install Mechanism
There is no automatic install spec (instruction-only install), so nothing is downloaded or written by an installer. The included scripts are placed with the skill package; they rely on existing system binaries (python3, ffmpeg). No external archives or remote installs are performed.
Credentials
The skill declares no required env vars in registry metadata but SKILL.md requires WEBNOVEL_QUARTZ_ROOT and optionally NANO_BANANA_KEY / WEBNOVEL_DRAFT_ROOT. The optional NANO_BANANA_KEY would be a credential used only for cover generation, which is reasonable if used, but it should be declared in metadata. The mismatch between declared and actual environment/credentials is disproportionate and should be corrected.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global agent config, and only writes into user-specified Quartz directories. Publishing defaults to copying (not deleting) drafts unless --move is explicitly used. No elevated privileges or persistent presence are requested.
What to consider before installing
This package is mostly coherent with its stated purpose (local authoring → lint → copy → index update → image conversion). Before installing, check these things: (1) update/confirm metadata: python3 and ffmpeg are required and WEBNOVEL_QUARTZ_ROOT is mandatory — the registry should list them; (2) inspect scripts yourself (they are small and readable) to confirm they will only operate on the directories you point at; (3) if you plan to use cover-generation, confirm how NANO_BANANA_KEY is used and only provide that key if you trust the Nano Banana Pro service; (4) run python3 scripts/prepublish_check.py in the skill folder to verify nothing unexpected is present; (5) run publish_workflow on a test copy of your Quartz vault to confirm behavior (the default is to copy, not delete drafts). The main risks here are metadata/documentation mismatches (surprising requirements) and possible AV false positives from the prepublish_check signatures — not evidence of remote exfiltration. If you want higher assurance, ask the publisher to correct the registry fields or provide a signed release.Like a lobster shell, security has layers — review code before you run it.
latestvk978abg40exjz3747yfwhqxc8180zk13
License
MIT-0
Free to use, modify, and redistribute. No attribution required.