skill-creator

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides utility scripts (scripts/init_skill.py and scripts/package_skill.py) intended to be executed by the agent to automate the creation of skill directory structures and the packaging of skills into zip files. These scripts utilize standard Python libraries for local file and directory management.
  • [DYNAMIC_EXECUTION]: The initialization script (scripts/init_skill.py) generates template files, including an executable Python script (scripts/example.py), from internal templates. This is a low-risk behavior consistent with the skill's primary purpose as a project generator.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to generate instructions for new skills, creating a potential surface for indirect prompt injection. Evidence: 1. Ingestion points: User requests for skill functionality and behavior. 2. Boundary markers: No explicit delimiters are mandated in the generated SKILL.md templates. 3. Capability inventory: Local file writing and execution via the provided Python scripts. 4. Sanitization: The quick_validate.py script performs basic sanitization by checking for angle brackets and enforcing naming conventions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 04:48 PM