skill-creator

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses subprocess calls to interact with the claude CLI and to run internal scripts for aggregation and evaluation. These calls are used to execute tests and perform model-based optimizations, which is the primary function of the skill.
  • [EXTERNAL_DOWNLOADS]: The viewer.html file loads the SheetJS library from cdn.sheetjs.com. This is a well-known service used for processing and displaying spreadsheet data in the browser and is considered safe in this context.
  • [DATA_EXFILTRATION]: The generate_review.py script starts a local HTTP server on 127.0.0.1 to serve evaluation results to the user. This enables local visualization of data and does not involve sending sensitive information to external third-party servers.
  • [DYNAMIC_EXECUTION]: The skill dynamically creates and manages files in the .claude/commands/ directory. This mechanism is used to simulate skill availability and test triggering accuracy during the development lifecycle.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 10:08 PM
Security Audit — agent-trust-hub — skill-creator