skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts (
scripts/init_skill.pyandscripts/quick_validate.py) to automate the creation and verification of skill directories. These scripts perform standard file system operations such as directory creation (mkdir), file writing (write_text), and permission modification (chmod 755) within the designated/home/ubuntu/skills/workspace. - [DATA_EXPOSURE]: The skill documentation and scripts interact with a specific local directory structure (
/home/ubuntu/skills). This is a standard practice for development-oriented skills and does not involve accessing sensitive user credentials or system configuration files outside the intended scope. - [INDIRECT_PROMPT_INJECTION]: The
init_skill.pyscript accepts a user-provided skill name and interpolates it into generated file templates. While this presents a theoretical surface for path traversal or content injection if the input is malicious, the script is designed for use in a controlled development environment, and thequick_validate.pytool provides subsequent validation of naming conventions.
Audit Metadata