skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Python
subprocessmodule to execute local scripts and system commands necessary for its development workflow. - Scripts such as
scripts/run_eval.pyandscripts/improve_description.pyinvoke theclaudeCLI to perform automated testing and description optimization. - The
eval-viewer/generate_review.pyscript useslsofto manage network ports when starting its local visualization server. SKILL.mdprovides instructions for using standard system commands likekillto manage local processes.- [EXTERNAL_DOWNLOADS]: The visualization component (
eval-viewer/viewer.html) fetches established third-party resources from well-known services: - The SheetJS library for rendering Excel files is loaded from
cdn.sheetjs.com(a well-known JavaScript library CDN). - Typography is enhanced using Google Fonts from
fonts.googleapis.com. - [SAFE]: The local server started by the viewer is strictly bound to the loopback interface (
127.0.0.1), ensuring that evaluation data is not exposed over the network. The skill's behavior is entirely consistent with its documented purpose as a developer productivity tool.
Audit Metadata