uw-skill-creator
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule inscripts/run_eval.pyandscripts/improve_description.pyto invoke theclaudeCLI tool for running evaluations and optimizing skill descriptions. It also usessubprocess.runineval-viewer/generate_review.pyto call thelsofutility to manage local port usage for the viewer server. - [DYNAMIC_EXECUTION]: To test triggering accuracy,
scripts/run_eval.pydynamically generates temporary markdown files in the.claude/commands/directory at runtime. These files are used to simulate the presence of a skill for the platform's trigger evaluation logic. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
eval-viewer/viewer.html) loads the SheetJS library fromcdn.sheetjs.com. This is a well-known service used to provide spreadsheet rendering capabilities within the browser-based review interface. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its processing of evaluation data.
- Ingestion points: Test prompts are read from
evals/evals.jsonand user feedback is read fromfeedback.jsonto guide improvements. - Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are used when interpolating these fields into subagent tasks.
- Capability inventory: The skill possesses capabilities for writing files to the filesystem and executing commands via the Claude CLI.
- Sanitization: No evidence of input validation, escaping, or filtering was found for data ingested from external JSON files before it is processed by the agent.
Audit Metadata