story-setup

story-setup is a skill for Claude Code from zenstory-ai/oh-story-claudecode. It costs 97 tokens per session (5,064 once invoked), scanned A, original, MIT.

A setup tool for deploying a Chinese web-fiction writing toolkit into a project. It configures supported coding agents and uses shared files for environments without a dedicated integration.

In plain words
What is it for?
Use it to install the toolkit for supported agent environments or generic file-based use, after checking that its reference folders and setup scripts are complete.
Why use it?
It prepares the writing environment without replacing existing user settings, reducing manual setup and configuration conflicts.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: reads .claude/ paths; mentions CLAUDE.md; names the AskUserQuestion tool.

Part of the story-setup plugin — 1 skill, 13 commands shipped together , and of oh-story

Good fit Use it to install the toolkit for supported agent environments or generic file-based use, after checking that its reference folders and setup scripts are complete.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/zenstory-ai/oh-story-claudecode/story-setup
About the project

oh-story-claudecode is a skill package for planning, analyzing, and writing Chinese web fiction, covering both short and long novels. It is intended for writers using Claude Code, Codex, OpenClaw, and other supported AI-agent environments, with workflows for market research, story breakdowns, drafting, editing, and cover creation. The catalogue entries are the package's skills, commands, agents, and plugin.

zenstory-ai/oh-story-claudecode · 8,063 stars · on GitHub · zenstory.ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add zenstory-ai/oh-story-claudecode --skill story-setup
Clone the repo
git clone --depth 1 https://github.com/zenstory-ai/oh-story-claudecode

Made for: Claude Code.

Or install story-setup, the plugin that ships this one along with the rest of its 1 skill, 13 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for story-setup

README.md
[![agentmods](https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/story-setup/github.svg)](https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/story-setup)
Your own site
<a href="https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/story-setup"><img src="https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/story-setup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for story-setup

Your own site · 80×15
<a href="https://agentmods.dev/skills/zenstory-ai/oh-story-claudecode/story-setup"><img src="https://agentmods.dev/badge/skills/zenstory-ai/oh-story-claudecode/story-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 97 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,064 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket warn 27 Oct 2026
  • Snyk pass 27 Oct 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 9 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Agent Snooping · line 294
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • high Agent Snooping · line 451
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • high Agent Snooping · line 451
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • medium MCP Rug Pull · line 17
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 23
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 320
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 512
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium Rogue Agent · line 403
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
  • medium Rogue Agent · line 403
    Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
    Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00097 $0.05064
Opus 5.5 $0.00039 $0.02026
Sonnet 5.5 $0.00019 $0.01013
Haiku 4.5 $0.00010 $0.00506

Measured yesterday against content hash e0f79674c029, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

story-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

skills/story-setup/SKILL.md · 159 lines

How it starts

The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.

story-setup:网文写作工具集基础设施部署

你负责把网文写作工具集部署到用户项目目录:已适配的 CLI 使用专用 hooks/agents/config;NarraFork、Web AI、自定义 Agent 等使用通用文件模式。

保留用户配置;受管文件按清单更新,共同维护的文件按管理块合并。

作者第一次部署的顺序:判断当前宿主 → 确认项目根 → 按宿主部署 → 验收 → 告诉作者下一步。本文件写公共流程;各宿主的部署清单、算法、校验和报告提示见 Phase 2 对应文件,只读本次目标宿主的那一份。

选择模式

  • 参数为 check,或用户只要求检查部署、诊断环境、排查 agent 不可用时:完整读取 references/diagnostics.md,按其中流程仅检查并报告;不进入下面的部署流程。
  • 用户要求安装、更新或修复时:执行下面的部署流程。检查后已明确授权的修复沿用本文件与宿主部署文件的部署与合并规则。

Phase 1:判断宿主与项目

先自检参考目录:以正在执行的本 SKILL.md 所在目录为准,列出与它同级的 references/ 下的子目录,核对下面 9 个名字是否都在且都非空——agent-references、templates、opencode、codex、antigravity、zcode、openclaw、reasonix、generic;同级 references/deploy-*.md(8 份宿主部署文件)、scripts/merge-claude-settings.py、scripts/merge-codex-hooks.py、scripts/merge-antigravity-hooks.py、scripts/generate-antigravity-agents.mjs、scripts/deploy-antigravity-skills.py、scripts/merge-project-instructions.py 与 scripts/copy-path-safety.py 也必须存在(宿主部署步骤、Claude/Codex/Antigravity hooks 合并、Antigravity Skills 物化与 agent 生成、项目指令合并、递归复制安全检查依赖它们)。有缺即 skill 包没装全,立即停止,不写任何部署文件,报告里区分「缺目录」「目录为空」和「缺脚本或部署文件」,并给修复指令:「story-setup 参考资料包不完整,缺 {路径}。按你的安装方式重装 oh-story-claudecode(命令行装的重跑 npx skills add zenstory-ai/oh-story-claudecode -y -g,marketplace / Plugin Management 装的在面板里重装),再执行 /story-setup。」

判据是「有没有 SKILL.md」:只看正在执行的 SKILL.md 同级的 references/。项目内 .claude/skills/story-setup/、.codex/skills/story-setup/ 和 OpenCode 的 skills/story-setup/ 只有 references/agent-references/、不含 SKILL.md,不会是执行目录,也不要拿它们核对。Antigravity / ZCode / OpenClaw / Reasonix / generic 的项目副本是整份 skill 拷贝、自带 SKILL.md,9 个子目录本就齐全,照常核对即可。

  1. 检查当前目录是否已部署过(存在 .story-deployed)
    • agents_version 缺失、非整数或小于 37 → 标记为待更新,继续执行当前部署
    • agents_version: 37 → 使用 AskUserQuestion 确认是否重新部署;提示里写明重新部署只用当前本地 skill 包刷新项目文件,要拿 skill 本身的新版本得先更新 oh-story-claudecode(npx skills add 或 marketplace),再回来重跑
    • agents_version 大于 37 → 当前 story-setup 比项目部署旧;停止以避免降级覆盖,提示先更新 oh-story-claudecode,不写任何部署文件
    • 同时读 target_cli 字段。已部署项目以 sentinel 里的值为准:非空时(逗号分隔的多端组合原样保留)这些端照常重新部署,不再让作者选;第 4 步仍判断当前宿主:判断出来且不在其中(作者换了软件)→ AskUserQuestion 问「这个文件夹之前是给 {已部署宿主名} 装的,你现在用的是 {当前宿主名},要一起装上吗?」(「一起装上(推荐)」「只更新原来的」),选前者就加进 target_cli;判断不出不问。字段缺失或为空才走第 4-6 步。用户明确要求增删目标端时,用 AskUserQuestion 在现有值基础上改,改完的值写回 sentinel。
    • target_cli 不含 opencode、但项目里有 .opencode/plugins/story-hooks.ts 或 .opencode/agents/(多端部署时 OpenCode 曾被版本门拦下)→ 用 AskUserQuestion 问是否把 OpenCode 加回来;选加回则先过 references/deploy-opencode.md 的「部署前置」,通过后写回 target_cli
  2. 检查是否有书名目录(包含 追踪/ 子目录的目录,或用户自定义结构)
    • 有 → 识别为长篇项目,显示当前项目信息
    • 无 → 识别为新项目或短篇项目
  3. 检查 .active-book 文件是否存在:存在 → 显示当前活跃书目;不存在 → 跳过
  4. 判断当前宿主(能判断就不问作者)。依次看,第一条能定下来的就用:
    • 你自身的运行环境:系统提示、可用工具名或 skill 调用语法已表明你运行在 Claude Code、Codex、OpenCode、Google Antigravity(含命令行 agy)、ZCode、OpenClaw 或 Reasonix 里;
    • 正在执行的本 SKILL.md 的安装位置带有宿主专属目录(如 .claude/、.codex/、.zcode/、.gemini/、.openclaw/、.opencode/);
    • 判断不出(例如网页版 AI、自建 Agent,或以上信号互相矛盾)→ 第 5 步的项目标记只当候选,交第 6 步问作者。
  5. 看项目里已有哪些宿主的标记:
    • .claude/ 或 CLAUDE.md → target_cli = claude-code
    • opencode.json、opencode.jsonc 或 .opencode/ → target_cli = opencode
    • .codex/、.codex/config.toml、.codex/agents/、.codex/hooks.json、AGENTS.md 中的 Codex 段 → target_cli = codex
    • .agents/hooks.json、.agents/agents/,或 .agents/rules/oh-story.md 中的 Antigravity 标记 → target_cli = antigravity
    • .zcode/、.zcode/config.json、zcode.json、.zcode/skills/、.zcode/commands/、AGENTS.md 中的 ZCode 段 → target_cli = zcode
    • openclaw.json、.openclaw/,或 AGENTS.md 中的 OpenClaw 段(标题行含 网文写作工具集(OpenClaw))→ target_cli = openclaw
    • .reasonix/、reasonix-plugin.json、REASONIX.md,或 AGENTS.md 中的 Reasonix 段(标题行含 网文写作工具集(Reasonix))→ target_cli = reasonix
    • AGENTS.md 中的通用段(标题行含 网文写作工具集(通用 Agent / Web AI))→ target_cli = generic
    • CLAUDE.md / AGENTS.md 里的 <!-- oh-story:{宿主} 开始 管理块 → target_cli 含该宿主

Read the full file on GitHub · 159 lines

Files

What ships with it

60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed e0f79674c029
  2. 4d ago Changed 1c499ff4c99d
  3. 10d ago Changed · -7 lines 72547aa7c09f
  4. 11d ago Changed 6f481fb865a2
  5. 12d ago Changed fb94430e2e0f
  6. 1mo ago Changed · -389 lines scan D → A 99fe0545686d
  7. 1mo ago Changed b3fa64103ca3
  8. 1mo ago Changed 934bbe9411d5
  9. 1mo ago Changed · +8 lines scan B → D 1e0f41cd04a2
  10. 1mo ago First seen · 547 lines · 97 tokens per session scan B b28f4ccc3a66

Subscribe to this mod's changes

story-setup is a skill published in the GitHub repository zenstory-ai/oh-story-claudecode (8,063 stars, last pushed yesterday), licensed MIT. It adds 97 tokens to every session and 5,064 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories