skills/dwsy/agent/skill-creator/Gen Agent Trust Hub

skill-creator

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.Popen and subprocess.run to interact with the system environment. It specifically executes the pi CLI for running evaluations and lsof to manage network ports for the local feedback viewer. These actions are transparently documented and necessary for its function as a developer toolkit.
  • [DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of new skills and scripts. While this involves generating and running executable content, it is the primary purpose of the tool and is performed locally within the user's workspace.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided feedback and generated evaluation queries. It mitigates potential risks by using specific system instructions for subagents that restrict tool usage and file access during evaluation cycles.
  • [EXTERNAL_DOWNLOADS]: The evaluation viewer template fetches well-known resources from Content Delivery Networks, including Google Fonts and the SheetJS library for rendering spreadsheets. These are used solely for the user interface of the results viewer.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 11:23 PM