skill-creator

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module in several utility scripts (run_eval.py, improve_description.py, run_loop.py) to execute the claude CLI and other internal scripts. This functionality is used to benchmark skill triggering and automate the improvement loop by interacting with the local development environment.
  • [DYNAMIC_EXECUTION]: The skill starts a local HTTP server on 127.0.0.1:3117 using the http.server module to provide a user interface for reviewing evaluation results. It also dynamically generates temporary command files in the .claude/commands directory to test how the agent handles newly created skills.
  • [EXTERNAL_DOWNLOADS]: The evaluation viewer HTML template references the SheetJS library from cdn.sheetjs.com for spreadsheet rendering and fonts from fonts.googleapis.com. These are well-known, trusted services used for standard document processing and UI styling.
  • [SAFE]: The skill instructions explicitly direct the agent to follow a "Principle of Lack of Surprise," stating that skills must not contain malware or facilitate unauthorized access. All code provided in the skill supports its stated purpose of skill development and optimization without hidden or malicious behaviors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 09:28 AM