skill-creator

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen in several scripts (improve_description.py, run_eval.py, run_loop.py) to invoke the claude CLI. This is the intended mechanism for performing 'trigger tests' to see if a skill description correctly activates the model. These calls are well-scoped to the tool's purpose.
  • [DYNAMIC_EXECUTION]: The eval-viewer component generates and serves dynamic HTML content from local evaluation results to facilitate human review. It also includes a generate_review.py script that acts as a local HTTP server for this UI, which is a standard pattern for developer tooling in this context.
  • [SAFE]: While the skill performs extensive filesystem operations (creating workspaces, saving transcripts, writing JSON metadata) and executes local scripts, these actions are consistent with its primary purpose as a benchmark and iteration harness for AI agent development. No signs of prompt injection, credential harvesting, or unauthorized exfiltration were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 07:09 AM