mj-skill-creator
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates various shell commands to manage the development lifecycle, including git operations (status, add, commit, push) and the execution of local Python maintenance scripts located in
~/.codex/skills/.system/. - [EXTERNAL_DOWNLOADS]: It utilizes
npx skills addto fetch and globally install skill packages from the vendor's own GitHub repository (makerjackie/skills). Use of the--yesflag automates this process by bypassing manual confirmation prompts. - [DATA_EXFILTRATION]: As part of its publishing workflow, the skill pushes locally generated or updated skill source code to a remote GitHub repository. This is the intended behavior for deploying the created skills.
- [REMOTE_CODE_EXECUTION]: The skill executes code from a remote source by installing packages directly from GitHub into the agent's environment. This behavior is restricted to the vendor's repository and is consistent with the skill's primary purpose.
- [DYNAMIC_EXECUTION]: The tool dynamically generates functional skill components, including
SKILL.mdandopenai.yamlconfiguration files, based on user-provided descriptions of tasks and workflows.
Audit Metadata