skill-creator

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands via Python's subprocess and os modules. These include running evaluations with claude -p, managing background processes with nohup and kill, and utility tasks like checking port availability with lsof. These actions are well-scoped to the tool's primary purpose of skill development and benchmarking.
  • [EXTERNAL_DOWNLOADS]: The evaluation viewer (viewer.html) references the SheetJS library from cdn.sheetjs.com. This is a well-known and trusted service used here for the legitimate purpose of rendering spreadsheet files in the browser for user review.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of code within subagents and test environments to benchmark skill performance. This is the core functionality of the skill creator. The instructions and code provided include specific safeguards and adherence to the 'Principle of Lack of Surprise' to ensure the agent does not facilitate malicious activities during the creation process.
  • [DATA_EXFILTRATION]: The skill captures timing data and evaluation results, saving them to local files like timing.json and grading.json. There are no patterns indicating the unauthorized transmission of sensitive data to external servers; the local HTTP server is used solely for the user to review their own local data.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 08:58 AM