skill-creator
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes an evaluation configuration (
eval.yaml) that executes a local JavaScript script (graders/check-skill.js) using Node.js. This script is used to validate the structure of skill drafts by checking for required sections and frontmatter. - [PROMPT_INJECTION]: The skill processes user-provided draft files to assist in the authoring process. This creates an indirect prompt injection surface where instructions within a draft file could influence the agent's behavior during the rewriting process. However, this is an inherent part of the skill's function as an editing tool.
- Ingestion points: draft/SKILL.md (loaded via the evaluation workspace)
- Boundary markers: None identified for the ingested draft content
- Capability inventory: Reading and rewriting local files as part of the authoring workflow
- Sanitization: No explicit sanitization or filtering of the draft content is performed
- [SAFE]: The skill provides security best practices for authors, such as recommending the use of guarded inline shell commands and the declaration of minimum required tools in frontmatter.
Audit Metadata