zenstory-ai/oh-story-claudecode story-setup
Checked the catalogued skill at story-setup.
F; retained sample includes a critical finding · SD-001 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
A set by no findings on this axis
8 suppressed by AI triage
The file is documentation explaining legitimate use of relative paths; no malicious code detected.
Configures normal Google search endpoint, not a malicious outbound call.
Configures normal Bing search endpoint, not a malicious outbound call.
Script uses standard Google search URL, not an exfiltration or malicious payload.
Configures fallback to Bing search after Google failure, a normal outbound call.
The script legitimately uses relative path traversal to locate its project root, a common safe operation.
The detected hook modification is a harmless advisory comment block inserted by a tooling script, not executing malicious actions.
The path reference is within a comment, not used in code, so it poses no traversal risk.