p-skill-creator
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
init_skill.pyandquick_validate.py) located in the system directory~/.codex/skills/.system/skill-creator/scripts/to bootstrap and verify new skill files. - [COMMAND_EXECUTION]: Automates Git workflows including
git add,git commit, andgit pushto synchronize local changes with the repository path defined in thePJ_CODEX_CONFIGenvironment variable. - [EXTERNAL_DOWNLOADS]: Uses
npxto execute theskillspackage, which is used to add and update skill definitions from the author's GitHub repository (github.com/ShengLin1001/codex-config.git). - [DATA_INGESTION]: Processes user-provided descriptions and workflow requirements to generate executable skill files. This ingestion point is an inherent part of the tool's purpose as a code generator.
- Ingestion points: User input for display names, descriptions, and workflow logic during the initialization phase.
- Boundary markers: None explicitly defined for the generated content.
- Capability inventory: The skill has access to the local filesystem for file creation, Python for script execution, Git for network synchronization, and Node.js (via npx).
- Sanitization: Standard template interpolation is used; no explicit sanitization of user-provided workflow text is mentioned before file writing.
Audit Metadata