Webnovel Serial Pipeline
Analysis
The skill appears to be a transparent local workflow for drafting and publishing Quartz web-novel files, with disclosed file-writing behavior and optional cover-generation credentials to review.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
# Publish workflow that should ONLY be run after the user says: "검수 완료". ... copy draft -> Quartz ... sync_index.py
The publish workflow intentionally copies reviewed drafts into the Quartz content folder and syncs the index. This is disclosed and approval-gated, but it is still a local content mutation users should notice.
need python3 need ffmpeg
The bundled dependency check requires local binaries even though the registry metadata declares no required binaries or environment variables. This is not hidden behavior, but installers may not surface the prerequisites automatically.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
NANO_BANANA_KEY (only if you generate covers using nano-banana-pro)
The skill documents an optional provider API key for cover generation. This is purpose-aligned and no bundled code shows leakage or hardcoded credentials, but it is a credential users should handle carefully.