Dream Novel Writer
Security checks across malware telemetry and agentic risk
Overview
This skill is internally consistent with its stated purpose (novel authoring) but has some implementation/usage notes you should review—most importantly it assumes a Node.js runtime (not declared) and its instructions require the agent to silently continue producing chapters autonomously, which could have surprising effects or costs.
This skill appears to do what it says (templates + two Node.js CLI scripts for assembling prompts and managing JSON state), but review these before installing: - Ensure Node.js is available and that you are comfortable the skill will execute node scripts; the registry metadata does not list Node as a required binary (the SKILL.md expects it). Install will fail or behave unexpectedly without Node. - Confirm the project path before use. The agent is instructed to default to ~/novels/<book_name> if the user doesn't specify; verify the path the agent will use. Do not let the agent write to system or sensitive directories. - The SKILL.md requires the agent to 'silently' and repeatedly continue writing chapters until completion. If you allow autonomous invocation, the agent could continue generating content and making many API calls/writes without further prompts — consider requiring explicit user confirmation between chapters or limiting the maximum number of auto-continued chapters. - Inspect the bundled scripts locally: they perform filesystem read/write only and do not make network calls. Confirm you are comfortable with the files they create (characters.json, foreshadowing.json, world.json, summary.json and chapter_X.md). - If you want tighter safety: (1) declare/verify Node runtime requirement; (2) run the skill in a sandboxed environment or restrict the allowed project directory; (3) modify SKILL.md to remove or require confirmation for the '静默开始下一章' behavior; (4) review and run the scripts manually once to see outputs and ensure they behave as expected. Confidence is medium because the code is small and readable (no obfuscation or network calls), but the missing runtime declaration and the forced-autonomous behavior create practical risks that depend on how you intend to use the skill.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
VirusTotal findings are pending for this skill version.