skill-manager

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill functions as a documentation and management hub for creating and editing AI agent skills. It establishes standard core principles, such as progressive disclosure and trigger-based descriptions, to improve agent performance and context management.\n- [COMMAND_EXECUTION]: The skill includes a local utility script, scripts/inspect-description.ts, which is executed using the Bun runtime. Security analysis of the script confirms it is a linter that validates YAML frontmatter, character counts, and file existence. It performs read-only filesystem operations and contains no network requests, dynamic code execution (like eval), or obfuscated commands.\n- [DATA_EXFILTRATION]: The skill documentation references absolute file paths associated with the author's local environment (/Users/melvynx/). These references are used to point the agent to other relevant local skills for research and do not constitute a sensitive data leak or credential exposure. No network exfiltration patterns were detected.\n- [SAFE]: Documentation in references/claude-code.md describes the use of platform-native features like allowed-tools (Read, Edit, Bash) and dynamic context injection (!command). The examples provided are benign and serve to educate the user/agent on official platform capabilities without introducing malicious payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 04:32 PM
Security Audit — agent-trust-hub — skill-manager