agent-skill-creator

SUSPICIOUS: the skill's broad build/audit purpose is mostly coherent, but its footprint is unusually expansive. The main risks are autonomous skill installation, processing untrusted external content while retaining write/exec powers, and transitive trust in generated or installed skills; the same-repo raw bootstrap adds moderate supply-chain risk but is not by itself evidence of malware.

No direct evidence of overt malicious payloads (e.g., hardcoded exfil URLs, keylogging, cryptomining, reverse shells) is present in this fragment. However, it performs high-impact actions typical of a supply-chain management tool: it executes external commands and, critically, runs skill-provided scripts/run_evals.py during gating and copies installed skill directories into destination locations. This creates a substantial risk if untrusted skills are processed and if sandboxing/controls are not enforced elsewhere (not visible here). Overall: medium likelihood of malicious intent cannot be confirmed, but operational security risk is high due to code execution on untrusted artifacts.

This module is an evaluation/orchestration harness with a high-impact security surface: it executes spec-provided shell commands using subprocess.run(shell=True) and can also execute a locally configured judge command from an environment variable. Additionally, when API judging is enabled, it transmits (truncated) produced output text to an external LLM service using an API key. No clear obfuscated payloads or overt backdoor malware are present in this snippet; however, if an attacker can influence the spec/skill_dir or EVAL_JUDGE_CMD, it can function as an arbitrary code execution vector and a potential data-exfiltration mechanism.

This module itself contains no obvious malicious payloads, obfuscated strings, hardcoded credentials, or network exfiltration. However, it is a supply-chain execution orchestrator: when the --run path is used, it spawns subprocesses to execute local verification scripts (and may execute a runner located inside the provided skill_dir). If an attacker can control or tamper with the skill directory contents (or the referenced gate scripts in the surrounding project), this can enable arbitrary code execution under the runner’s privileges. Additionally, the --cache path is user-supplied and not restricted, creating potential overwrite risk in unsafe contexts.

No clear malware or covert supply-chain attack is present. The code is a purpose-built evaluation harness, but it executes specification-controlled shell commands with inherited environment access and can transmit generated outputs plus criteria to Anthropic when --judge is enabled. Treat evaluation specifications and skill directories as trusted code, restrict path resolution, and avoid judging sensitive outputs through the external API.

The code implements expected local skill-registry operations and shows no direct malware indicators such as network exfiltration, command execution, credential theft, or obfuscation. It has meaningful path-traversal and arbitrary-file-deletion risks if registry.json is untrusted or tampered with: validate registry paths for containment before install/remove, sanitize or constrain installation names, and avoid recursive deletion outside approved roots. The apparent incomplete `main(` ending would also make the supplied fragment syntactically invalid.

The code is a plausible installer and contains no evident malware in the provided fragment. It performs broad but purpose-related filesystem changes and installs mutable remote repository content into multiple AI-agent skill locations. The main risks are unpinned supply-chain content, remote-script execution in the documented usage, and recursive deletion of existing installation paths. Review and pin a trusted commit or release before use.

This wrapper is a thin installer bootstrap that performs high-risk supply-chain behavior: it downloads an unpinned remote PowerShell script and executes it immediately in-memory using `iex`, while also bypassing PowerShell execution policy. The wrapper itself is not obviously malicious, but the network-to-code execution pattern without integrity checks warrants treating the installation process as potentially dangerous until the referenced remote `bootstrap.ps1` is reviewed and the retrieval is secured (pinning to a commit and verifying hash/signature).