skill-creator-cc
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_eval.pyusessubprocess.Popento execute theclaudeCLI tool for testing skill triggering and task completion. This behavior is documented and necessary for the skill's evaluation functions. - [EXTERNAL_DOWNLOADS]: The skill integrates with the
anthropicPython library to access description optimization models and mentions theopenskillsNode.js package in the README. These dependencies are standard for the skill's optimization and installation workflows. - [PROMPT_INJECTION]: The evaluation framework processes test queries provided by the user.
- Ingestion points: Queries are loaded from JSON files in
scripts/run_eval.py. - Boundary markers: Queries are passed as command-line arguments to the
claudeCLI. - Capability inventory: The skill uses
subprocess.Popento run local tools. - Sanitization: No specific sanitization is performed as the queries are intended for diagnostic testing of other skills.
Audit Metadata