p-skill-creator

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts (init_skill.py and quick_validate.py) located in the system directory ~/.codex/skills/.system/skill-creator/scripts/ to bootstrap and verify new skill files.
  • [COMMAND_EXECUTION]: Automates Git workflows including git add, git commit, and git push to synchronize local changes with the repository path defined in the PJ_CODEX_CONFIG environment variable.
  • [EXTERNAL_DOWNLOADS]: Uses npx to execute the skills package, which is used to add and update skill definitions from the author's GitHub repository (github.com/ShengLin1001/codex-config.git).
  • [DATA_INGESTION]: Processes user-provided descriptions and workflow requirements to generate executable skill files. This ingestion point is an inherent part of the tool's purpose as a code generator.
  • Ingestion points: User input for display names, descriptions, and workflow logic during the initialization phase.
  • Boundary markers: None explicitly defined for the generated content.
  • Capability inventory: The skill has access to the local filesystem for file creation, Python for script execution, Git for network synchronization, and Node.js (via npx).
  • Sanitization: Standard template interpolation is used; no explicit sanitization of user-provided workflow text is mentioned before file writing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 01:51 PM