skill-creator

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen to invoke the claude CLI for running evaluations and optimizing skill descriptions. It also uses lsof to manage local network ports. These operations are performed using argument lists rather than shell strings, which significantly reduces the risk of shell injection.- [EXTERNAL_DOWNLOADS]: No external downloads or remote script executions were detected. The skill relies on local scripts and the pre-installed claude CLI environment.- [DATA_EXFILTRATION]: The skill includes a local HTTP server (generate_review.py) used to host a review interface for test results. This server binds to 127.0.0.1 and is intended for local inspection of workspace files generated during the skill creation process. No unauthorized network communication or data transmission patterns were identified.- [DYNAMIC_EXECUTION]: The skill generates HTML reports and interactive review pages by embedding JSON data into predefined templates. This mechanism is used for visualization purposes and does not involve the execution of untrusted code in the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 12:09 AM