skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a developer-centric utility that manages the local skill development workflow. All operations, such as command execution and process management, are performed locally and serve the tool's intended functional goals.
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule to interact with theclaudeCLI and manage local processes. Specifically, it executesclaude -pto evaluate triggering accuracy and useslsofandkillto manage the lifecycle of the local review server. These are standard operations for a local development and benchmarking tool. - [PROMPT_INJECTION]: The skill implements an evaluation pipeline where subagents (defined in
agents/grader.mdandagents/comparator.md) process transcripts and output files from other agent runs. While this introduces an indirect prompt injection surface (Category 8), the risk is mitigated by the intended use case of evaluating a developer's own skills within a local environment. - [EXTERNAL_DOWNLOADS]: The review viewer interface loads the
xlsxprocessing library fromcdn.sheetjs.com, a well-known and trusted service, to enable rendering of spreadsheet outputs during the review process.
Audit Metadata