skill-comply

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and shlex.split across multiple scripts (runner.py, spec_generator.py, scenario_generator.py, classifier.py) to execute the claude CLI and setup sandbox environments. This is functional and necessary for its purpose of measuring agent compliance in a controlled environment.
  • [COMMAND_EXECUTION]: The runner.py script executes agent-generated setup_commands within a temporary sandbox directory (/tmp/skill-comply-sandbox). It includes a path traversal check (relative_to) to ensure commands stay within the intended sandbox base.
  • [SAFE]: While the skill interacts with external LLMs via the claude CLI, it does so to process non-sensitive skill definitions and behavioral traces for classification and report generation. No hardcoded credentials or unauthorized data exfiltration patterns were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 04:01 AM
Security Audit — agent-trust-hub — skill-comply