create-skill

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves the latest specification and frontmatter schema from https://agentskills.io using WebFetch. This behavior ensures that the generated skills are compliant with the most recent platform requirements.
  • [COMMAND_EXECUTION]: Standard filesystem commands including mkdir, ln, chmod, and test are used to initialize the skill directory, create symlinks for agent discovery, and verify the integrity of the created files. These operations are strictly confined to the local project directories (.agents and .claude).
  • [PROMPT_INJECTION]: The instructions contain workflow guidelines and model-specific optimization tips that are intended to improve the quality of the generated skills. There are no attempts to bypass safety filters or ignore prior instructions.
  • [DATA_EXFILTRATION]: No unauthorized data access or exfiltration patterns were detected. The skill explicitly forbids modifying global system directories and focuses entirely on the local working directory scope.
  • [SAFE]: The skill behaves as a standard developer tool with transparent operations and no signs of obfuscation, credential harvesting, or persistence mechanisms outside of the intended project structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 08:03 AM
Security Audit — agent-trust-hub — create-skill