skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or persistence mechanisms were detected. The skill instructions and scripts are well-structured and follow established security best practices.
- [COMMAND_EXECUTION]: The skill provides Python utilities (
init_skill.py,package_skill.py,quick_validate.py) intended for local development workflows. These scripts perform deterministic file operations (creating, reading, and zipping files) based on explicit user-provided paths. - [DATA_EXFILTRATION]: The packaging logic in
scripts/package_skill.pyexplicitly mitigates unauthorized data exposure by skipping symbolic links and verifying that all resolved file paths remain within the intended skill root directory (_is_withincheck). This prevents malicious skills from attempting to bundle sensitive system files via path traversal or link manipulation.
Audit Metadata