skill-creator

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONMETADATA_POISONING
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module across several scripts (scripts/run_eval.py, scripts/improve_description.py, eval-viewer/generate_review.py) to manage its internal loop. It executes the claude CLI and system tools like lsof and kill. These are standard requirements for its stated purpose as an automation harness for skill development.
  • [DYNAMIC_EXECUTION]: The scripts/run_eval.py script dynamically constructs and writes temporary Markdown files to .claude/commands/ to test triggering logic. It also uses the claude -p command to evaluate these triggers. This is an expected behavior for a tool designed to optimize skill descriptions.
  • [METADATA_POISONING]: The SKILL.md file contains instructions to make skill descriptions "pushy" to encourage model triggering. While this involves manipulating model behavior, it is documented as a best practice for this specific developer tool to overcome current platform limitations and is not deceptive.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:51 PM