create-teammate

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a suite of local Python scripts located in the tools/ directory to perform data collection, parsing, and file management tasks. These operations are essential to the skill's primary function and are executed within the agent's local environment.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates data collection from well-known services including Slack and GitHub via their official APIs. These operations are initiated by the user and require the manual configuration of API tokens. Usage of these well-known technology domains is considered safe under the trust-scope rules.
  • [PROMPT_INJECTION]: The skill processes large volumes of untrusted external data (e.g., chat logs, PR comments) to generate new AI personas. This creates a surface for indirect prompt injection. However, the skill implements multiple mitigation strategies, including a 'Privacy Guard' to remove secrets, 'Quality Gates' to validate generated output, and 'Smoke Tests' to ensure the resulting persona maintains its character boundaries. These measures significantly reduce the risk of malicious instructions being incorporated into the generated skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 01:44 AM
Security Audit — agent-trust-hub — create-teammate