skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandsubprocess.Popento invoke theclaudeCLI for running evaluations and optimizing skill descriptions. It also useslsofto manage local network ports. These operations are performed using argument lists rather than shell strings, which significantly reduces the risk of shell injection.- [EXTERNAL_DOWNLOADS]: No external downloads or remote script executions were detected. The skill relies on local scripts and the pre-installedclaudeCLI environment.- [DATA_EXFILTRATION]: The skill includes a local HTTP server (generate_review.py) used to host a review interface for test results. This server binds to127.0.0.1and is intended for local inspection of workspace files generated during the skill creation process. No unauthorized network communication or data transmission patterns were identified.- [DYNAMIC_EXECUTION]: The skill generates HTML reports and interactive review pages by embedding JSON data into predefined templates. This mechanism is used for visualization purposes and does not involve the execution of untrusted code in the agent's context.
Audit Metadata