Scanned skills

zenstory-ai/oh-story-claudecode story-setup

Checked the catalogued skill at story-setup.

SkillTrust corpus scan 19 September 2026 v0.10.0 via skillsh Verify on GitHub
F AI-triaged 17
F Security

F; retained sample includes a critical finding · SD-001 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

showing 10 of 17
permission_hygienehigh SD-003
SKILL.md
securityhigh SD-014
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
securityhigh SD-014
SKILL.md
securitymedium SD-008
SKILL.md
securitymedium SD-008
SKILL.md
permission_hygienehigh SD-003
references/templates/hooks/check-prose-after-write.sh
permission_hygienehigh SD-003
references/templates/hooks/guard-outline-before-prose.sh
securitycritical SD-001
references/templates/hooks/lib/common.sh
8 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
UPGRADING.md

The file is documentation explaining legitimate use of relative paths; no malicious code detected.

transparencymedium SD-007 benign_example
references/codex/agents/story-researcher.toml

Configures normal Google search endpoint, not a malicious outbound call.

transparencymedium SD-007 benign_example
references/codex/agents/story-researcher.toml

Configures normal Bing search endpoint, not a malicious outbound call.

transparencymedium SD-007 benign_example
references/codex/agents/story-researcher.toml

Script uses standard Google search URL, not an exfiltration or malicious payload.

transparencymedium SD-007 benign_example
references/codex/agents/story-researcher.toml

Configures fallback to Bing search after Google failure, a normal outbound call.

permission_hygienehigh SD-003 benign_example
references/codex/hooks/run-story-hook.sh

The script legitimately uses relative path traversal to locate its project root, a common safe operation.

securityhigh SD-014 benign_example
references/opencode/pre-commit.sh

The detected hook modification is a harmless advisory comment block inserted by a tooling script, not executing malicious actions.

permission_hygienehigh SD-003 benign_example
references/opencode/pre-commit.sh

The path reference is within a comment, not used in code, so it poses no traversal risk.