skill-creator
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runandsubprocess.Popenin several scripts (improve_description.py,run_eval.py,run_loop.py) to invoke theclaudeCLI. This is the intended mechanism for performing 'trigger tests' to see if a skill description correctly activates the model. These calls are well-scoped to the tool's purpose. - [DYNAMIC_EXECUTION]: The
eval-viewercomponent generates and serves dynamic HTML content from local evaluation results to facilitate human review. It also includes agenerate_review.pyscript that acts as a local HTTP server for this UI, which is a standard pattern for developer tooling in this context. - [SAFE]: While the skill performs extensive filesystem operations (creating workspaces, saving transcripts, writing JSON metadata) and executes local scripts, these actions are consistent with its primary purpose as a benchmark and iteration harness for AI agent development. No signs of prompt injection, credential harvesting, or unauthorized exfiltration were detected.
Audit Metadata