skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python scripts including
scripts/init_skill.pyandscripts/package_skill.pythat automate the creation of directory structures and ZIP archives on the local filesystem. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface because it reads and processes external configuration and metadata files to perform validation and packaging.
- Ingestion points:
scripts/quick_validate.pyandscripts/package_skill.pyread theSKILL.mdfile and other directory contents. - Boundary markers: Absent; the content is parsed without specific delimiters to ignore embedded instructions.
- Capability inventory:
scripts/init_skill.pyperforms file and directory creation;scripts/package_skill.pyreads local files and writes ZIP archives. - Sanitization:
scripts/quick_validate.pyenforces constraints on the 'name' and 'description' metadata fields using regular expressions. - [SAFE]: Documentation in
references/script-quality-criteria.mdprovides guidance for managing API keys and secrets using.envfiles and environment variables, following industry best practices. - [SAFE]: The skill recommends using well-known package managers such as
npm,npx, andpipxfor tool integration, as outlined inreferences/creation-process.mdandreferences/script-quality-criteria.md.
Audit Metadata