skill-creator
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- System Utility Execution for Packaging: The
package_skill.cjsscript uses thespawnSyncmethod to invoke system tools such asziportar. This procedure is used to archive skill directories into a distributable format and is a standard part of the skill lifecycle. - Local File System Management: The initialization script creates necessary directories and template files on the local machine. It incorporates path validation logic to prevent directory traversal, ensuring that file operations are confined to the user-specified output path.
- Automation via Local Scripts: The skill instructions guide the agent to run included Node.js scripts for deterministic tasks like directory setup and content validation. These scripts utilize built-in Node.js modules to ensure consistency without relying on external dependencies.
- User-Centric Security Model: The skill explicitly instructs the agent to seek user confirmation before installation and highlights that administrative actions, such as reloading the skills environment, must be performed manually by the user. This maintains clear oversight of the agent's capabilities.
Audit Metadata