better-skill-creator

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scaffolding templates generated by the skill include functionality to manage local development environments. This includes creating virtual environments via the venv module and installing dependencies using pip. The creator script itself uses os.chmod to set appropriate execution permissions on generated scripts.
  • [EXTERNAL_DOWNLOADS]: The project documentation provides an installation hint for the uv package manager pointing to the official astral.sh domain. This is a well-known service in the Python ecosystem and the reference is for legitimate developer tooling setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a template-based generation system that ingests user-provided skill names and levels. A mandatory evidence chain analysis shows that ingestion occurs through the scaffold.py command-line interface, where inputs are strictly sanitized via regex in the validate_name function to prevent path traversal or structural injection. The system uses {{TOKEN}} markers as clear boundaries for content replacement, and its capabilities are limited to local file system operations within the specified output directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 03:22 PM