skills/nicepkg/vsync/skill-creator/Gen Agent Trust Hub

skill-creator

Fail

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: CRITICALCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes Python scripts (scripts/init_skill.py, scripts/package_skill.py, and scripts/quick_validate.py) to perform file system operations. These scripts are intended to automate the creation of skill templates, validate their structure, and package them into distributable archives. Specifically, scripts/init_skill.py generates a new directory structure and populates it with template markdown and script files, while scripts/package_skill.py crawls a local directory and creates a compressed ZIP archive with a .skill extension.
  • [DATA_EXPOSURE]: While the packaging utility reads local files to create archives, its behavior is restricted to the directories specified by the user or agent and is consistent with the skill's purpose. No evidence of unauthorized file access or exfiltration to remote servers was found.
  • [SAFE]: The skill does not contain prompt injections, obfuscated code, or hardcoded credentials. All operations are transparent and serve the primary function of assisting in the development of other skills. The use of chmod in the initialization script is restricted to making its own template scripts executable, which is standard practice for scaffolding tools.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jul 23, 2026, 04:44 AM
Security Audit — agent-trust-hub — skill-creator