skill-creator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule in several utility scripts (run_eval.py,improve_description.py,run_loop.py) to execute theclaudeCLI and other internal scripts. This functionality is used to benchmark skill triggering and automate the improvement loop by interacting with the local development environment. - [DYNAMIC_EXECUTION]: The skill starts a local HTTP server on
127.0.0.1:3117using thehttp.servermodule to provide a user interface for reviewing evaluation results. It also dynamically generates temporary command files in the.claude/commandsdirectory to test how the agent handles newly created skills. - [EXTERNAL_DOWNLOADS]: The evaluation viewer HTML template references the SheetJS library from
cdn.sheetjs.comfor spreadsheet rendering and fonts fromfonts.googleapis.com. These are well-known, trusted services used for standard document processing and UI styling. - [SAFE]: The skill instructions explicitly direct the agent to follow a "Principle of Lack of Surprise," stating that skills must not contain malware or facilitate unauthorized access. All code provided in the skill supports its stated purpose of skill development and optimization without hidden or malicious behaviors.
Audit Metadata