skill-creator

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several Python scripts to automate a development loop. scripts/run_eval.py and scripts/improve_description.py execute the claude CLI via the subprocess module to perform evaluations and content generation. This is the primary intended mechanism for the skill's benchmarking functionality.
  • [COMMAND_EXECUTION]: The eval-viewer/generate_review.py script uses subprocess to call lsof and kill to manage local network ports and clean up the evaluation viewer process.
  • [EXTERNAL_DOWNLOADS]: The evaluation viewer (viewer.html) references the SheetJS library from a well-known CDN (cdn.sheetjs.com) to allow users to view Excel files generated during tests directly in their browser. This is a standard practice for web-based data visualization.
  • [DATA_EXFILTRATION]: The eval-viewer script reads local output files (such as logs, images, and documents) from a designated workspace and embeds them into a standalone HTML file. While this involves reading local data, it is the intended purpose of the viewer to facilitate local human review of test results.
  • [REMOTE_CODE_EXECUTION]: The skill generates instructions and scripts based on user input and then executes them using the platform's CLI (claude -p). While this represents a broad capability, it is consistent with the skill's stated purpose as a development environment for AI agent extensions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 02:22 PM
Security Audit — agent-trust-hub — skill-creator