skill-creator

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Python subprocess module to execute local scripts and system commands necessary for its development workflow.
  • Scripts such as scripts/run_eval.py and scripts/improve_description.py invoke the claude CLI to perform automated testing and description optimization.
  • The eval-viewer/generate_review.py script uses lsof to manage network ports when starting its local visualization server.
  • SKILL.md provides instructions for using standard system commands like kill to manage local processes.
  • [EXTERNAL_DOWNLOADS]: The visualization component (eval-viewer/viewer.html) fetches established third-party resources from well-known services:
  • The SheetJS library for rendering Excel files is loaded from cdn.sheetjs.com (a well-known JavaScript library CDN).
  • Typography is enhanced using Google Fonts from fonts.googleapis.com.
  • [SAFE]: The local server started by the viewer is strictly bound to the loopback interface (127.0.0.1), ensuring that evaluation data is not exposed over the network. The skill's behavior is entirely consistent with its documented purpose as a developer productivity tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 12:01 AM
Security Audit — agent-trust-hub — skill-creator