pencil-skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a local initialization script at
scripts/init_pencil_design_system_skill.pyintended for automating the creation of new skill directories and files. The script uses standard Python libraries likepathlibandshutilfor these tasks. - [SAFE]: The initialization script validates the provided design system name against a kebab-case regular expression (
pencil-ui-design-system-[a-z0-9]+(?:-[a-z0-9]+)*), which prevents path traversal or shell injection via the input name. - [SAFE]: The skill does not perform any network operations, external downloads, or access sensitive system configuration files.
- [SAFE]: The generated skill files are based on static templates provided within the script, ensuring the output is predictable and follows established safe patterns for the Pencil ecosystem.
Audit Metadata