skills/ninehills/skills/skill-creator/Gen Agent Trust Hub

skill-creator

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a complex developer tool designed to facilitate the creation and evaluation of other agent skills. It utilizes subagents and local scripts to automate testing workflows.
  • [COMMAND_EXECUTION]: Several scripts (run_eval.py, improve_description.py, run_loop.py) utilize Python's subprocess module to execute the claude CLI and manage local files. These operations are core to the skill's functionality, which involves testing how Claude responds to various prompts with specific skill context.
  • [EXTERNAL_DOWNLOADS]: The eval-viewer/viewer.html file includes a reference to a well-known third-party library (SheetJS via cdn.sheetjs.com) to enable spreadsheet rendering in the results viewer. This is a standard practice for web-based tools and targets a reputable service.
  • [DATA_EXPOSURE]: The skill manages temporary command files in the .claude/commands/ directory and creates local workspace folders to store evaluation results. This data management is localized to the user's project environment and is necessary for the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided test queries through an evaluation pipeline. While this involves processing untrusted data, the queries are used as inputs for testing other agents, and the skill includes appropriate handling (such as YAML block scalars in generated config files) to maintain boundaries.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 12:42 PM