skill-creator
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: CRITICAL
Full Analysis
- [SAFE]: The skill provides utility scripts (
init_skill.py,package_skill.py,quick_validate.py) intended for local use by the agent or developer. Analysis of these scripts confirms they perform legitimate file management and validation tasks related to the skill's stated purpose. - [SAFE]: The packaging tool (
package_skill.py) implements security safeguards such as explicitly ignoring symlinks and verifying that files stay within the intended directory root to prevent directory traversal attacks during the archival process. - [SAFE]: The validation tool (
quick_validate.py) checks for required metadata and enforces constraints on skill naming and description fields (e.g., prohibiting angle brackets), which helps mitigate basic metadata poisoning and injection risks. - [SAFE]: Although automated reputation scanners flagged
SKILL.md, the contents are purely instructional documentation for creating skills. The scripts provided do not contain hardcoded credentials, network exfiltration patterns, or obfuscated malicious payloads.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata