sc
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill's integration test suite (
scripts/tests/test_sc_scripts_integration.py) utilizessubprocess.run()to execute local Python scripts during testing. These calls are restricted to internal project files usingsys.executableand do not ingest external or unsanitized input. - [DYNAMIC_EXECUTION]: The skill implements automated file generation and modification via
init_skill.pyandrename_skill.py. These scripts include strict validation for skill names (using regex^[a-z0-9][a-z0-9.-]*$) to prevent injection attacks and ensure generated files adhere to required naming conventions. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests user input to generate new skill documentation and scripts, it operates within a fixed directory structure and uses template-based generation. The provided validation tools (
quick_validate.py) check for compliance with security best practices, such as ensuring all file references are relative and preventing cross-skill path manipulation.
Audit Metadata