skill-creator
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Python
subprocessmodule to orchestrate local developer workflows. It executes theclaudeCLI for running skill evaluations and improving descriptions, and useslsofto manage network ports for its internal review server. These executions are performed using list-based arguments without a shell, following secure coding practices for programmatic command invocation. - [EXTERNAL_DOWNLOADS]: The skill's evaluation viewer references the SheetJS library from a well-known content delivery network (
cdn.sheetjs.com). This external dependency is used solely for the client-side rendering of spreadsheet files within the human-review interface and does not involve the execution of untrusted remote code on the host system. - [DYNAMIC_EXECUTION]: The skill implements a self-improvement loop where it dynamically evaluates skill performance and uses LLM feedback to refine instructions and descriptions. This behavior is the primary intended purpose of the tool and is performed with user oversight through the included evaluation viewer.
Audit Metadata