skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using local automation scripts (e.g., scripts/init_skill.py and scripts/package_skill.py) for skill initialization and packaging.
- [COMMAND_EXECUTION]: The workflow directs the agent to generate new executable code and then test its functionality by "actually running" the scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where user-supplied skill names or directory paths could be passed as arguments to shell commands. The guide mitigates this risk by recommending that the agent normalize these inputs into a specific format (hyphen-case), which serves as a form of sanitization.
- [SAFE]: No malicious patterns, hidden code, data exfiltration, or safety guideline bypasses were identified in the instructions.
Audit Metadata