skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule inrun_eval.py,improve_description.py, andgenerate_review.pyto execute local CLI commands such asclaudeandlsof. These operations are required for its primary function of testing skills and managing the local evaluation viewer.- [DATA_EXPOSURE]:generate_review.pystarts a local HTTP server and reads files from a specified workspace to embed them in a review page. This behavior is scoped to the development workspace and intended for qualitative review by the developer.- [DYNAMIC_EXECUTION]: The skill facilitates the execution of other agent skills during its testing phase and uses Claude to dynamically generate and optimize skill descriptions. This is a core feature of the skill's purpose as a development harness.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes user-provided test prompts and skill content during evaluations. While this creates a surface for indirect prompt injection, the risk is inherent to the tool's function as a skill development framework and is mitigated by its intended use in a local development context.
Audit Metadata