skill-creator

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes local Python scripts (scripts/init_skill.py and scripts/quick_validate.py) to automate the creation and verification of skill directories. These scripts perform standard file system operations such as directory creation (mkdir), file writing (write_text), and permission modification (chmod 755) within the designated /home/ubuntu/skills/ workspace.
  • [DATA_EXPOSURE]: The skill documentation and scripts interact with a specific local directory structure (/home/ubuntu/skills). This is a standard practice for development-oriented skills and does not involve accessing sensitive user credentials or system configuration files outside the intended scope.
  • [INDIRECT_PROMPT_INJECTION]: The init_skill.py script accepts a user-provided skill name and interpolates it into generated file templates. While this presents a theoretical surface for path traversal or content injection if the input is malicious, the script is designed for use in a controlled development environment, and the quick_validate.py tool provides subsequent validation of naming conventions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 02:53 PM
Security Audit — agent-trust-hub — skill-creator