skill-creator

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Filesystem Scaffolding: The init_skill.py script creates local directories and writes template files (SKILL.md, example scripts, and reference docs) based on user input. These operations are scoped to the path provided by the user and are part of the skill's primary purpose as a creation tool.
  • Script Permission Management: The tool automatically sets executable permissions (chmod +x) on generated template scripts. While this involves modifying file attributes, it is a standard practice for initializing development resources meant to be executed by an agent.
  • Safe Data Processing: The validation utility quick_validate.py uses yaml.safe_load when parsing skill metadata. This is a recommended security practice that prevents unsafe deserialization of potentially untrusted YAML content from other skills being validated.
  • Local Operation Scope: All scripts operate entirely on the local filesystem. There are no network operations, external downloads, or exfiltration patterns detected in the analyzed files.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 01:41 AM
Security Audit — agent-trust-hub — skill-creator