skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides utility scripts (scripts/init_skill.py, scripts/package_skill.py) that perform file system operations such as directory creation and ZIP packaging to facilitate skill development.
- [DYNAMIC_EXECUTION]: The scripts/init_skill.py script generates a boilerplate Python file from a fixed internal template during the initialization of a new skill.
- [PRIVILEGE_ESCALATION]: The scripts/init_skill.py script applies executable permissions to the generated boilerplate script to allow immediate use in the development workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill creation process involves ingesting user-provided descriptions into the generated skill metadata, which represents a potential surface for indirect injection if the resulting skill is later processed by an agent without proper boundary markers.
Audit Metadata