skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands via Python's
subprocessandosmodules. These include running evaluations withclaude -p, managing background processes withnohupandkill, and utility tasks like checking port availability withlsof. These actions are well-scoped to the tool's primary purpose of skill development and benchmarking. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
viewer.html) references theSheetJSlibrary fromcdn.sheetjs.com. This is a well-known and trusted service used here for the legitimate purpose of rendering spreadsheet files in the browser for user review. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code within subagents and test environments to benchmark skill performance. This is the core functionality of the skill creator. The instructions and code provided include specific safeguards and adherence to the 'Principle of Lack of Surprise' to ensure the agent does not facilitate malicious activities during the creation process.
- [DATA_EXFILTRATION]: The skill captures timing data and evaluation results, saving them to local files like
timing.jsonandgrading.json. There are no patterns indicating the unauthorized transmission of sensitive data to external servers; the local HTTP server is used solely for the user to review their own local data.
Audit Metadata