create-agent-skill
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: All identified functionalities, including file creation and script generation, are strictly aligned with the skill's primary purpose as a meta-tool for development. No suspicious patterns or unauthorized behaviors were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill reviews and iterates on external skill files, which is a known vulnerability surface. However, the instructions incorporate safety-conscious workflows to minimize risk.
- Ingestion points: User-provided instructions and existing skill files (SKILL.md, references).
- Boundary markers: The workflow enforces a planning-only phase and requires explicit user confirmation before any file-writing intent is executed.
- Capability inventory: Writing files to the project directory and executing local bundled scripts as defined in the 'Scripts' section.
- Sanitization: The skill instructions focus on consistency, terminology, and logic review, relying on the agent's core safety filters for input processing.
- [DYNAMIC_EXECUTION]: The skill provides comprehensive guidelines for the agent to generate and run local automation scripts. These guidelines emphasize safety through requirements for idempotency, non-interactive execution, and the inclusion of dry-run or confirmation flags for destructive operations.
Audit Metadata