skill-creator

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • System Utility Execution for Packaging: The package_skill.cjs script uses the spawnSync method to invoke system tools such as zip or tar. This procedure is used to archive skill directories into a distributable format and is a standard part of the skill lifecycle.
  • Local File System Management: The initialization script creates necessary directories and template files on the local machine. It incorporates path validation logic to prevent directory traversal, ensuring that file operations are confined to the user-specified output path.
  • Automation via Local Scripts: The skill instructions guide the agent to run included Node.js scripts for deterministic tasks like directory setup and content validation. These scripts utilize built-in Node.js modules to ensure consistency without relying on external dependencies.
  • User-Centric Security Model: The skill explicitly instructs the agent to seek user confirmation before installation and highlights that administrative actions, such as reloading the skills environment, must be performed manually by the user. This maintains clear oversight of the agent's capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 12:40 PM
Security Audit — agent-trust-hub — skill-creator