Skills/ClawHub/story-short-analyze

story-short-analyze@1.1.30

CAUTION· static only

Publisher claims: "短篇网文拆文。拆解爆款短篇小说（番茄短篇 / 故事会 / 知乎盐言 / 追妻 / 世情 / 重生 / 虐渣等通俗题材）的故事核、结构、情感线、反转设计、写作手法、共鸣层次。单一全量拆解管道：跑完 Stage 2-6 产出完整拆文报告，落盘到 拆文库/{书名}/，下游 story-short-write 同时读拆文报告 + 情节节点 + 写作手法 + 原文 + _meta.json 写下一篇。触发方式：/story-short-analyze、/短篇拆文、「拆短篇」「拆这篇短文」「短篇拆文」「精细拆解短篇」「8000 字短篇拆解」「番茄短篇拆文」「故事会拆解」「盐言故事拆解」「分析这篇短篇」——均进入同一管道。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher worldwonderer · publishing for 42 daysInstalls 2,266Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-07 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
File type combined with upload actionSKILL.md:130 · File type combined with upload action — agent may exfiltrate local data files**Stage 写盘规则**（中断后可续）：每个 Stage 开始前写入 `_meta.json.last_stage_in_progress`；目标文件写完、确认非空且长度合理后，才清空它并 append 到 `stages_completed[]`。半成品不可信，续跑时该 Stage 整段重跑。完整规则见 output-contract.md「写入顺序」。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:87 · File type combined with upload action — agent may exfiltrate local data files输出到 `拆文库/{书名}/`（项目根目录下；用户指定了其他路径时按用户指定）：`原文/`、`拆文报告.md`、`情节节点.md`、`写作手法.md`、`_meta.json`。三个 markdown 由下游 `story-short-write` 硬编码读取，不可改名；文件树、Stage → 文件映射与 `_meta.json` 字段见 [references/output-contract.mFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈1,584 tok
1 file · 18 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim worldwonderer: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim worldwondererPropose a patch to the maintainer