skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule in several scripts (scripts/run_eval.py,scripts/improve_description.py, andeval-viewer/generate_review.py) to execute helper scripts and interact with theclaudeCLI. This functionality is essential for the skill's primary purpose of automating the skill development and optimization workflow. - [EXTERNAL_DOWNLOADS]: The HTML viewer templates (
eval-viewer/viewer.htmlandassets/eval_review.html) reference external JavaScript and CSS resources from well-known and trusted services. Specifically, it uses the SheetJS library fromcdn.sheetjs.comfor processing Excel files and Google Fonts fromfonts.googleapis.com. These are standard UI dependencies and do not represent a security risk. - [DATA_EXFILTRATION]: To provide a user-friendly interface for reviewing test results,
eval-viewer/generate_review.pyimplements a local HTTP server using the standard Python library. It serves data only to the local machine (localhost) and is used solely to facilitate the human-in-the-loop review process. - [REMOTE_CODE_EXECUTION]: While the skill executes local scripts via the shell, all scripts are bundled within the skill itself. It does not download or execute arbitrary code from untrusted remote sources.
Audit Metadata