create-skill

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a development framework for authoring, refactoring, and auditing AI agent skills. It implements the 'npow' orchestration pattern, which focuses on progressive disclosure, state management, and behavioral discipline.
  • [REMOTE_CODE_EXECUTION]: While the instructions mention command-line tools such as npm, pip, curl, and bash, these references are within the context of teaching the agent how to build or verify other skills. There are no patterns of direct remote script execution (e.g., curl | bash) originating from the skill itself.
  • [INDIRECT_PROMPT_INJECTION]: As a tool designed to generate code and instructions from user input, it possesses an inherent indirect prompt injection surface. The skill mitigates this by requiring the inclusion of a 'Security constraints' section and 'iron-law verification gates' in the skills it produces, enforcing a least-privilege and evidence-based execution model.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 08:42 PM