skill-creator

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a developer-centric utility that manages the local skill development workflow. All operations, such as command execution and process management, are performed locally and serve the tool's intended functional goals.
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module to interact with the claude CLI and manage local processes. Specifically, it executes claude -p to evaluate triggering accuracy and uses lsof and kill to manage the lifecycle of the local review server. These are standard operations for a local development and benchmarking tool.
  • [PROMPT_INJECTION]: The skill implements an evaluation pipeline where subagents (defined in agents/grader.md and agents/comparator.md) process transcripts and output files from other agent runs. While this introduces an indirect prompt injection surface (Category 8), the risk is mitigated by the intended use case of evaluating a developer's own skills within a local environment.
  • [EXTERNAL_DOWNLOADS]: The review viewer interface loads the xlsx processing library from cdn.sheetjs.com, a well-known and trusted service, to enable rendering of spreadsheet outputs during the review process.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 10:00 PM
Security Audit — agent-trust-hub — skill-creator