skill-creator
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a complex developer tool designed to facilitate the creation and evaluation of other agent skills. It utilizes subagents and local scripts to automate testing workflows.
- [COMMAND_EXECUTION]: Several scripts (
run_eval.py,improve_description.py,run_loop.py) utilize Python'ssubprocessmodule to execute theclaudeCLI and manage local files. These operations are core to the skill's functionality, which involves testing how Claude responds to various prompts with specific skill context. - [EXTERNAL_DOWNLOADS]: The
eval-viewer/viewer.htmlfile includes a reference to a well-known third-party library (SheetJSviacdn.sheetjs.com) to enable spreadsheet rendering in the results viewer. This is a standard practice for web-based tools and targets a reputable service. - [DATA_EXPOSURE]: The skill manages temporary command files in the
.claude/commands/directory and creates local workspace folders to store evaluation results. This data management is localized to the user's project environment and is necessary for the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided test queries through an evaluation pipeline. While this involves processing untrusted data, the queries are used as inputs for testing other agents, and the skill includes appropriate handling (such as YAML block scalars in generated config files) to maintain boundaries.
Audit Metadata