skill-creator

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module in several scripts (scripts/run_eval.py, scripts/improve_description.py, and eval-viewer/generate_review.py) to execute helper scripts and interact with the claude CLI. This functionality is essential for the skill's primary purpose of automating the skill development and optimization workflow.
  • [EXTERNAL_DOWNLOADS]: The HTML viewer templates (eval-viewer/viewer.html and assets/eval_review.html) reference external JavaScript and CSS resources from well-known and trusted services. Specifically, it uses the SheetJS library from cdn.sheetjs.com for processing Excel files and Google Fonts from fonts.googleapis.com. These are standard UI dependencies and do not represent a security risk.
  • [DATA_EXFILTRATION]: To provide a user-friendly interface for reviewing test results, eval-viewer/generate_review.py implements a local HTTP server using the standard Python library. It serves data only to the local machine (localhost) and is used solely to facilitate the human-in-the-loop review process.
  • [REMOTE_CODE_EXECUTION]: While the skill executes local scripts via the shell, all scripts are bundled within the skill itself. It does not download or execute arbitrary code from untrusted remote sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 05:07 PM
Security Audit — agent-trust-hub — skill-creator