skill-creator
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEMETADATA_POISONING
Full Analysis
- [METADATA_POISONING]: The
descriptionfield in.claude-plugin/plugin.jsoncontains the text"A skill for Tailwind # ❌ 25 chars". This is a verbatim copy of a "bad example" from the skill's own documentation inSKILL.md. While it misrepresents the skill's actual purpose in the plugin manifest, it appears to be a documentation error rather than a malicious attempt to poison the metadata index. - [EXTERNAL_DOWNLOADS]: The skill provides links to official specifications and example repositories hosted on Anthropic's official GitHub organization (
github.com/anthropics/skills). These references target well-known and trusted sources within the platform's ecosystem. - [COMMAND_EXECUTION]: The
SKILL.mdfile contains a command reference section detailing the use of local helper scripts (e.g.,./scripts/install-skill.sh,./scripts/check-metadata.sh). These scripts are presented as standard development tools for skill management and do not include patterns for remote code execution or unauthorized system access.
Audit Metadata