skill-surgeon
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several Python scripts (
scripts/run_eval.py,scripts/improve_description.py, andscripts/run_loop.py) that invoke theclaudeCLI via shell commands to test and optimize skill triggering. These operations are restricted to the local development environment and are documented as part of the skill's core evaluation workflow. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
eval-viewer/viewer.html) loads the SheetJS library fromcdn.sheetjs.com. This is a well-known service used here for the legitimate purpose of rendering spreadsheet outputs within the results viewer. - [SAFE]: The skill defines a 'Safe Edit Protocol' in
SKILL.mdthat mandates the use of before/after snapshots and verification comparisons when modifying files. This approach is a best practice designed to prevent the model from accidentally overwriting or corrupting skill instructions during updates. - [SAFE]: The
eval-viewer/generate_review.pyscript starts a local HTTP server using the standard libraryhttp.serverto provide a visual interface for reviewing test results. This server is intended for local use only and provides a productivity feature for the developer.
Audit Metadata