skill-installer
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages local skill discovery by reading from a project-internal
marketplace.jsonand parsing the documentation of neighboring skills. All file access operations are restricted to the local filesystem and follow standard directory navigation patterns. - [SAFE]: Analysis of the source and compiled code confirms no network operations, credential usage, or system-level command execution. The skill does not use tools like curl, wget, or fetch.
- [SAFE]: The installation functionality is implemented as a state-tracking mechanism that records 'installed' skills into a local JSON file (
installed_skills.json). It does not execute arbitrary scripts, install external packages via package managers, or perform any runtime code generation.
Audit Metadata