skill-creator

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the subprocess and os modules to automate developer workflows. Specifically:
  • scripts/run_eval.py uses subprocess.Popen to execute the claude CLI for trigger evaluation tests.
  • scripts/improve_description.py invokes claude -p to generate optimized skill descriptions.
  • eval-viewer/generate_review.py runs lsof and uses os.kill to manage local network ports for the evaluation viewer server.
  • These actions are standard for developer tooling and are performed within the local environment context.
  • [EXTERNAL_DOWNLOADS]: The eval-viewer/viewer.html template references the SheetJS (xlsx) library from cdn.sheetjs.com. This is a well-known and trusted external service used for processing spreadsheet data within the browser-based results viewer.
  • [SAFE]: The skill generates temporary markdown files and JSON metadata in .claude/commands/ and specified workspace directories to facilitate testing. This dynamic file creation is necessary for its function as a skill-testing harness and does not exhibit malicious patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 09:50 PM
Security Audit — agent-trust-hub — skill-creator