skill-creator
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes local Python scripts (
init-skill.py,package-skill.py) designed to manage the lifecycle of new skills. The instructions guide the agent to execute these scripts to initialize project structures and package finished skills into zip files. These actions are local and align with the skill's stated purpose as a developer tool. - [DYNAMIC_EXECUTION]: The initialization script (
init-skill.py) generates template files and a boilerplate Python script (example.py), applying executable permissions (chmod 0o755) to the latter. This is a standard scaffolding behavior for development utilities and does not involve remote code or obfuscated logic. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of new SKILL.md files by interpolating user-provided names and descriptions into templates. While this represents a data ingestion surface, the operations are local and the script uses standard path resolution to mitigate basic file system risks.
Audit Metadata