skill-comply
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandshlex.splitacross multiple scripts (runner.py,spec_generator.py,scenario_generator.py,classifier.py) to execute theclaudeCLI and setup sandbox environments. This is functional and necessary for its purpose of measuring agent compliance in a controlled environment. - [COMMAND_EXECUTION]: The
runner.pyscript executes agent-generatedsetup_commandswithin a temporary sandbox directory (/tmp/skill-comply-sandbox). It includes a path traversal check (relative_to) to ensure commands stay within the intended sandbox base. - [SAFE]: While the skill interacts with external LLMs via the
claudeCLI, it does so to process non-sensitive skill definitions and behavioral traces for classification and report generation. No hardcoded credentials or unauthorized data exfiltration patterns were found.
Audit Metadata