skill-creator

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several Python scripts (run_eval.py, run_loop.py, improve_description.py) that invoke the claude CLI via subprocess. These are used to run automated evaluations, benchmark skill performance, and propose improvements. While these execute shell commands, they are integral to the skill's purpose as a development environment for other skills.
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads assets for its evaluation viewer, specifically using the SheetJS library (cdn.sheetjs.com/xlsx) to render spreadsheet outputs in the HTML review interface. This is a standard use of a well-known service for data visualization.
  • [REMOTE_CODE_EXECUTION]: The skill is designed to execute other skills during its evaluation phase. This involves spawning subagents with access to user-defined skill paths. While this is dynamic execution, it is the primary functional intent of a 'Skill Creator' tool and operates within the platform's standard security boundaries for subagents.
  • [DATA_EXPOSURE]: The evaluation viewer (generate_review.py) reads files from the workspace directory to display them to the user for qualitative review. It specifically targets output directories and metadata files created during the testing process, which is expected behavior for a benchmarking tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 07:46 PM