CreateCLI

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill manages and retrieves configuration data, including API keys, from the local file ~/.claude/.env. This is a standard and recommended practice for secret management in the platform's development environment.
  • [COMMAND_EXECUTION]: The skill uses local shell commands for administrative tasks such as appending entries to a local execution log (~/.claude/LIFEOS/MEMORY/SKILLS/execution.jsonl), sending notifications to a local service via curl, and setting executable permissions on generated files using chmod +x.
  • [INDIRECT_PROMPT_INJECTION]: The skill translates user-provided requirements into functional code, which creates a potential surface for indirect prompt injection. However, the templates are structured to follow strict architectural principles to mitigate the risk of accidental execution of embedded instructions.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of established libraries like commander from the official NPM registry using bun add when upgrading tool complexity.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 06:48 PM
Security Audit — agent-trust-hub — CreateCLI