skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandsubprocess.Popenin several scripts (eval-viewer/generate_review.py,scripts/improve_description.py,scripts/run_eval.py,scripts/run_loop.py) to execute system commands such asclaude -p,lsof, andkill. These are integral to the skill's purpose of automating skill testing and management within the Claude environment and do not pose a risk beyond the intended functionality. - [EXTERNAL_DOWNLOADS]: The
eval-viewer/viewer.htmlfile includes the SheetJS library viacdn.sheetjs.comand Google Fonts viafonts.googleapis.com. These are well-known, trusted CDN services used for rendering spreadsheets and styling the review interface. - [SAFE]: The skill is authored by 'coinbase', and all internal script logic corresponds to the claimed functionality of a 'Skill Creator'. No data exfiltration or persistence mechanisms were detected.
Audit Metadata