create-skill

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several utility scripts (scripts/run_eval.py, scripts/improve_description.py, scripts/package_skill.py) that perform shell command execution using subprocess.run().
  • run_eval.py and improve_description.py execute the claude CLI to run prompts for benchmarking and optimization purposes.
  • package_skill.py executes a local validation script to ensure skill integrity before archiving.
  • [EXTERNAL_DOWNLOADS]: The workflow fetches live specifications and research data from several external domains using the WebFetch tool.
  • It fetches core specifications from agentskills.io and best practices from platform.claude.com (Anthropic).
  • It performs research by fetching content from skills.sh and reference implementations from the anthropics/skills GitHub repository.
  • These downloads target well-known documentation sources and trusted organizations as part of its core functionality.
  • [DYNAMIC_EXECUTION]: The skill is designed to generate and execute dynamic content as part of its lifecycle.
  • It generates new SKILL.md files and associated scripts based on user descriptions and fetched specifications.
  • The evaluation system executes this generated content using the claude CLI to verify task completion and trigger accuracy.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its processing of untrusted external content and user inputs into generated instructions.
  • Ingestion points: Data is ingested via WebFetch from multiple external sources and via AskUserQuestion from the user.
  • Boundary markers: The workflow utilizes EnterPlanMode to require explicit user approval of a blueprint before any files are written, and includes an 'Anti-Hallucination' section for verification logic.
  • Capability inventory: The skill has access to Bash, Write, Edit, WebFetch, and Task tools across its various phases.
  • Sanitization: The skill relies on user-in-the-loop approval and a static validator script to ensure the generated skill meets structural requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:06 PM