Skills
skills/gooseworks-ai/goose-skills/skill-creator/Gen Agent Trust Hub

skill-creator

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for skill lifecycle management.
  • [COMMAND_EXECUTION]: Uses the orth CLI tool for initializing, submitting, and updating skills.
  • [COMMAND_EXECUTION]: Executes python3 inline scripts to parse JSON configuration and extract API credentials from local files.
  • [DATA_EXFILTRATION]: The skill accesses a sensitive local file at ~/.gooseworks/credentials.json to retrieve authentication tokens. This exposure is required to interact with the vendor's API at api.gooseworks.ai and is consistent with the tool's intended use.
  • [EXTERNAL_DOWNLOADS]: The installation metadata specifies the use of npx goose-skills, which downloads and executes the goose-skills package from the npm registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 02:14 PM
Security Audit — agent-trust-hub — skill-creator