skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The scripts
run_eval.mjsandimprove_description.mjsuse thenode:child_processmodule to spawn theclaudeCLI tool. This is intended to automate the execution of test queries against the skill being developed or optimized. - [EXTERNAL_DOWNLOADS]: The evaluation viewer template (
viewer.html) fetches the SheetJS library from a public CDN (cdn.sheetjs.com). This is a well-known service used here to facilitate the rendering of spreadsheet data in the local result viewer. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data including skill definitions, evaluation queries, and execution transcripts. It uses these inputs to provide feedback and optimization suggestions. While this is an attack surface, the sub-agents (Grader, Analyzer, Comparator) are provided with specific roles and instructions to rely on evidence from transcripts, which helps mitigate the risk of accidental obedience to embedded instructions.
- Ingestion points: Reads
eval-setJSON files, skill markdown files, and execution transcripts vianode:fs. - Boundary markers: Employs structured variables and template interpolation for agent prompts.
- Capability inventory: Includes file system read/write via
node:fsand execution of theclaudeCLI viaspawn. - Sanitization: Relies on standard JSON parsing and file handling; sub-agents are explicitly instructed to cite evidence from the processed data.
- [DYNAMIC_EXECUTION]: The
run_eval.mjsscript dynamically creates temporary markdown files in the project's.claude/commandsdirectory and executes queries against them using theclaudeCLI. This mechanism is necessary for the skill's purpose of testing how other skills are triggered.
Audit Metadata