story-setup：网文写作工具集基础设施部署

• Outcome: Review
• Latest audit: Oct 18, 2026 · 5:30 AM UTC
• Version: 1.1.40

Overview

This is a coherent writing-tool setup skill, but it installs persistent hooks and includes unsafe trust-bypass guidance that users should review before installing.

Install only in a trusted writing project. Review and trust only the hooks you expect, do not use --dangerously-bypass-hook-trust in automation, avoid the curl-to-bash upgrade path, and remember that browser-cdp can control a logged-in Chrome session. Disable the update check with STORY_NO_UPDATE_CHECK=1 if automatic GitHub version checks are not acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/deploy-codex.md:32

Finding

Automation guidance bypasses trust for preserved project-controlled Codex hooks

Content

View full analysis

Vulnerability Details

File Location: references/deploy-codex.md, lines 32 and 50
Vulnerability Type: Execution of unreviewed project hooks through a trust-gate bypass
Risk Level: High

Complete Vulnerable Snippet

text

Line 32:
保留用户已有的非 story-setup hooks、matcher 块与未知顶层字段。

Line 50:
自动化里的 `codex exec` 可加 `--dangerously-bypass-hook-trust`

The instructions state that existing non-story-setup hooks and unknown configuration fields must be preserved. They later recommend that automation may invoke codex exec with --dangerously-bypass-hook-trust.

Technical Analysis

Project-local Codex hook configuration is an executable trust boundary. The deployment process intentionally preserves hook registrations that are not managed by this Skill. Such entries may originate from repository contributors rather than from the user running the automation.

Under the normal workflow, Codex’s hook trust mechanism provides a review and approval gate before these commands execute. The documented --dangerously-bypass-hook-trust option removes that gate for automation. Combining preserved project-controlled hooks with this option means that automation may execute commands that were neither installed nor validated by story-setup.

The issue is not the legitimate installation of the Skill’s own hooks. It arises because the bypass applies broadly while arbitrary existing hook entries remain in the resulting configuration.

Attack Path

1. An attacker with the ability to contribute files to a repository adds or modifies a non-story-setup command hook in .codex/hooks.json.
2. The victim deploys or updates story-setup. Following line 32, the deployment preserves the attacker-controlled hook because it is not recognized as a managed story-setup entry.
3. The repository is processed by automation using the documented codex exec --dangerously-bypass-hook-trust option.
4. Codex skips the normal review and trust decision for project hooks.
5. The attac ...[truncated 983 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to use --dangerously-bypass-hook-trust.
2. Require normal Codex review and trust approval for project-local hooks, including in automation.
3. If noninteractive execution is required, generate a dedicated automation hook configuration containing only exact story-setup-managed registrations.
4. Validate hook identities, executable paths, arguments, and configuration schema before enabling them.
5. Reject or disable unknown project hook entries in unattended environments rather than preserving and executing them.
6. Run automation with a least-privileged account, a minimal environment, restricted filesystem access, and no unnecessary service credentials.
7. Document that repositories and their .codex/hooks.json files must be treated as executable content rather than passive configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (196)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared setup-oriented triggers and descriptions do not prepare the user for runtime interception of write targets, workflow rule enforcement, or staged-file scanning. In context, that makes the skill more dangerous because broad setup triggers can invoke an unexpectedly powerful installer that persists into future sessions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

**先自检参考目录**：以正在执行的本 `SKILL.md` 所在目录为准，列出与它同级的 `references/` 下的子目录，核对下面 9 个名字是否都在**且都非空**——`agent-references`、`templates`、`opencode`、`codex`、`antigravity`、`zcode

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

**先自检参考目录**：以正在执行的本 `SKILL.md` 所在目录为准，列出与它同级的 `references/` 下的子目录，核对下面 9 个名字是否都在**且都非空**——`agent-references`、`templates`、`opencode`、`codex`、`antigravity`、`zcode

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

**先自检参考目录**：以正在执行的本 `SKILL.md` 所在目录为准，列出与它同级的 `references/` 下的子目录，核对下面 9 个名字是否都在**且都非空**——`agent-references`、`templates`、`opencode`、`codex`、`antigravity`、`zcode

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

**先自检参考目录**：以正在执行的本 `SKILL.md` 所在目录为准，列出与它同级的 `references/` 下的子目录，核对下面 9 个名字是否都在**且都非空**——`agent-references`、`templates`、`opencode`、`codex`、`antigravity`、`zcode

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

ttings.py`、`scripts/merge-codex-hooks.py`、`scripts/merge-antigravity-hooks.py`、`scripts/generate-antigravity-agents.mjs`、`scripts/deploy-antigravity-skills.py`、

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

- `openclaw.json`、`.openclaw/`，或 `AGENTS.md` 中的 OpenClaw 段（标题行含 `网文写作工具集（OpenClaw）`）→ `target_cli = openclaw`
   - `.reasonix/`、`reasonix-plugin.json`、`REASONIX.md`，或 `AGENTS.md` 中的 Reasonix 段（标题行含 `网文写作工具集（Reasonix）`）→ `target_cli = reasonix`
   - `AGENTS.md` 中的通用段（标题行含 `网文写作工具集（通用 Agent / Web AI）`）→ `target_cli = generic`
   - `CLAUDE.md` / `AGENTS.md` 里的 `<!-- oh-story:{宿主} 开始` 管理块 → `target_cli` 含该宿主

   > 后三类只认各端**互斥**的标记：`skills/*/SKILL.md` 的 `metadata.openclaw` 不作 OpenClaw 信号（13 个 skill 都带，三条 skills-only 路径部署出的 `skills/` 一样）；`.agents/skills/` 由 Antigravity、Codex 与 Reasonix 共用，也不单独作准。
6. 定下 `target_cli`：

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

- `openclaw.json`、`.openclaw/`,或 `AGENTS.md` 中的 OpenClaw 段(标题行含 `网文写作工具集(OpenClaw)`)→ `target_cli = openclaw`
   - `.reasonix/`、`reasonix-plugin.json`、`REASONIX.md`,或 `AGENTS.md` 中的 Reasonix 段(标题行含 `网文写作工具集(Reasonix)`)→ `target_cli = reasonix`
   - `AGENTS.md` 中的通用段(标题行含 `网文写作工具集(通用 Agent / Web AI)`)→ `target_cli = generic`
   - `CLAUDE.md` / `AGENTS.md` 里的 `<!-- oh-story:{宿主} 开始` 管理块 → `target_cli` 含该宿主

   > 后三类只认各端**互斥**的标记:`skills/*/SKILL.md` 的 `metadata.openclaw` 不作 OpenClaw 信号(13 个 skill 都带,三条 skills-only 路径部署出的 `skills/` 一样);`.agents/skills/` 由 Antigravity、Codex 与 Reasonix 共用,也不单独作准。
6. 定下 `target_cli`:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The documentation explicitly recommends curl -fsSL https://opencode.ai/v2/install | bash, which executes a remotely fetched script directly in the shell without prior inspection or integrity verification. In the context of a setup/upgrade skill that guides environment deployment, this is more dangerous because users are primed to copy-paste privileged installation commands, creating a realistic path for supply-chain compromise or remote code execution if the source, transport, or hosting is compromised.

Content

Scanner excerpt · UPGRADING.md (reported line 45)May include surrounding context.

md

OpenCode 2.0 起发布在 npm 包 `@opencode/cli`（`opencode-ai` 停在 1.x）。本适配只支持 2.x：1.x 的插件 loader 读不了新版 `story-hooks.ts`，在 1.x 上会没有写正文守卫与写后兜底；1.x 也不认 agents 的 `permissions:` 规则，只读 agent 会失去权限限制。story-setup 在版本是 1.x 或无法确定时停止部署。

1. 升级 OpenCode：先卸载旧包 `npm rm -g opencode-ai`，再 `npm i -g @opencode/cli`（或 `curl -fsSL https://opencode.ai/v2/install | bash`），确认 `opencode --version` 为 2.x。两个包都提供 `opencode` 命令，不先卸载旧包时 PATH 上可能仍是 1.x。
2. 更新技能包后，在写作项目根重跑 story-setup：替换 `.opencode/plugins/story-hooks.ts` 与 `.opencode/agents/`（改为 2.x 原生 `permissions:` 规则列表，已配的 `model:` 会保留），并从 `opencode.json` / `opencode.jsonc` 删除旧的 story-hooks 插件注册。

## 插件打包身份迁移（v0.7.9 同版本修复）

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/antigravity/hooks/story_antigravity_hook.js (reported line 159)May include surrounding context.

js

const key = path.resolve(target)
    const finding = core.proseAfterWrite(root, key)
    if (finding) state.findings[key] = finding
    else delete state.findings[key]
    changed = true
  }
  if (changed) {

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The always_on trigger causes these rules to be loaded in every session, regardless of whether the user is working on a story project. That broad activation increases the chance of unintended instruction injection, workspace scanning, or behavior override in unrelated contexts, especially because the file directs the agent to read additional skill content and enforce workflow rules automatically.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/deploy-claude-code.md (reported line 57)May include surrounding context.

md

先看 `.claude/settings.local.json` 是否存在：存在则读取现有配置，后续合并；不存在则由 helper 创建新文件。

1. 按现有跨平台规则探测 Python：`for PYBIN in python3 python py; do "$PYBIN" -c "" 2>/dev/null && break; done`；无可用解释器时停止，不手写或简化合并。
2. 调用 `"$PYBIN" "{story-setup skill目录}/scripts/merge-claude-settings.py" --existing "{项目}/.claude/settings.local.json" --template "{story-setup skill目录}/references/templates/settings-hooks.json" --output "{项目}/.claude/settings.local.json"`。
3. helper 会移除所有已知 story-setup hook 的历史注册，再追加当前模板；因此 matcher/timeout/if 能随版本升级，同时混在旧 block 中的用户 hook 与未知顶层字段原样保留。写后解析 JSON，验证模板命令各一份、用户配置仍在，再复跑 helper 比较文件字节确认幂等。

## 部署标记补充

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The document recommends curl ... | bash, which downloads and immediately executes a remote script without integrity verification or package-manager trust boundaries. If the remote host, transport, or published installer is compromised, the user could execute arbitrary code on their machine during setup.

Content

Scanner excerpt · references/deploy-opencode.md (reported line 11)May include surrounding context.

md

1. 运行 `opencode --version`，取第一个 `主.次.修` 版本号：
   - 主版本 ≥ 2 → 继续
   - 主版本 < 2 → 停止 OpenCode 部署（其它 target 照常），告诉用户先升级到 2.x（先 `npm rm -g opencode-ai`，再 `npm i -g @opencode/cli` 或 `curl -fsSL https://opencode.ai/v2/install | bash`），装好后重跑 story-setup
   - 命令不可用或解析不出版本 → 同样停止 OpenCode 部署，请用户在自己的终端运行 `opencode --version`：用户在对话里确认显示 2.x 后才继续；是 1.x 按上一条处理
   - 停止 OpenCode 部署时：target 只有 opencode 则不写、不更新 `.story-deployed`（已有的原样保留，不抬 `agents_version`），也不写任何 OpenCode 文件；多 target 时其它端照常部署，写入的 `target_cli` 不含 opencode；安装报告「现在可以做什么」只写装上的端，「你还需要做的事」里用白话说 OpenCode 这次没装上及原因（如版本太旧），升级后重新部署时选把它加回来
2. 插件由 OpenCode 自动发现 `.opencode/plugins/*.ts` 加载，不写 `opencode.json`。项目根已有 `opencode.json` / `opencode.jsonc` 时，从其 `plugin`、`plugins` 数组删掉指向 `.opencode/plugins/story-hooks.ts` 的项（旧版部署留下；2.x 丢弃单文件路径并告警），数组删空就删掉该键，其余内容原样保留。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The referenced command grants browser automation via CDP, including control of an already logged-in Chrome session, which is unrelated to the declared purpose of a writing-environment setup skill. This scope mismatch is dangerous because it introduces powerful access to authenticated web sessions and browsing context under a benign-seeming skill category, increasing the chance of abuse or unauthorized data access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Browser control and data scraping are high-risk capabilities because they can access sensitive content, perform authenticated actions, and extract data from sites using the user's existing session. In the context of a writing setup tool, this capability is unjustified and expands the attack surface far beyond what users would reasonably expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command file is inside the story-setup skill context, but its description and body explicitly invoke a different skill, story-review. This creates skill-identity confusion that can cause the agent to execute unintended capabilities, route user input to the wrong workflow, or bypass expected guardrails tied to the declared skill purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline documentation contradicts the surrounding skill identity by telling the agent to use a different skill. In agent ecosystems, documentation is often treated as executable routing guidance, so this contradiction can misdirect execution, confuse operators, and create an opportunity for hidden or accidental cross-skill invocation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: references/opencode/plugin.ts:32