BookMorph Magic
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a coherent book-to-content bundling template, with modest cautions around clearing output folders and saving local file paths in its manifest.
This skill looks safe to use as a local bundling template if you supply trusted adapters and keep it pointed at a dedicated output folder. Before installing or running it, confirm Python 3 is available, avoid using the clear/reset option on important directories, and review the generated manifest before sharing it.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the output root or episode prefix is chosen incorrectly, an existing episode folder could be deleted.
The helper can recursively remove an existing episode directory when the clear flag is used. This is disclosed and aligned with resetting an output bundle, but it is a destructive local action.
if existed and args.clear_existing:
shutil.rmtree(dest_dir)Use a dedicated output directory and verify the target path before running the clear/reset option.
If the manifest is shared, it may reveal local filenames, directory structure, book metadata, or workflow checkpoint locations.
The generated manifest records the selected book metadata and local path, and the script also records source output/checkpoint paths. This is useful for audit and resume workflows but persists local file-location information.
"selected_book": {
"title": args.book_title,
"author": args.author,
"path": str(book_path) if book_path else NoneReview or redact manifest paths before publishing or sharing the packaged episode.
The skill may not run as documented on systems without Python 3 available.
The documented workflow depends on running Python commands even though the registry metadata declares no required binaries. This is a setup clarity issue, not evidence of hidden installation behavior.
python3 {baseDir}/scripts/episode_bundle.py parse-episode --text "制作ep38内容"Ensure Python 3 is available before use, or update the skill metadata to declare the runtime requirement.