skill-creator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule across several scripts (scripts/run_eval.py,scripts/improve_description.py,eval-viewer/generate_review.py) to manage its internal loop. It executes theclaudeCLI and system tools likelsofandkill. These are standard requirements for its stated purpose as an automation harness for skill development. - [DYNAMIC_EXECUTION]: The
scripts/run_eval.pyscript dynamically constructs and writes temporary Markdown files to.claude/commands/to test triggering logic. It also uses theclaude -pcommand to evaluate these triggers. This is an expected behavior for a tool designed to optimize skill descriptions. - [METADATA_POISONING]: The
SKILL.mdfile contains instructions to make skill descriptions "pushy" to encourage model triggering. While this involves manipulating model behavior, it is documented as a best practice for this specific developer tool to overcome current platform limitations and is not deceptive.
Audit Metadata