better-skill-creator
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scaffolding templates generated by the skill include functionality to manage local development environments. This includes creating virtual environments via the
venvmodule and installing dependencies usingpip. The creator script itself usesos.chmodto set appropriate execution permissions on generated scripts. - [EXTERNAL_DOWNLOADS]: The project documentation provides an installation hint for the
uvpackage manager pointing to the officialastral.shdomain. This is a well-known service in the Python ecosystem and the reference is for legitimate developer tooling setup. - [INDIRECT_PROMPT_INJECTION]: The skill implements a template-based generation system that ingests user-provided skill names and levels. A mandatory evidence chain analysis shows that ingestion occurs through the
scaffold.pycommand-line interface, where inputs are strictly sanitized via regex in thevalidate_namefunction to prevent path traversal or structural injection. The system uses{{TOKEN}}markers as clear boundaries for content replacement, and its capabilities are limited to local file system operations within the specified output directory.
Audit Metadata