skill-compressor

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The unit test file scripts/test_measure_skill.py utilizes subprocess.check_output to verify the functionality of the measurement script. The command is restricted to calling the local Python interpreter and the project's own script within a controlled environment using temporary directories.\n- [DYNAMIC_EXECUTION]: The test suite uses importlib.util to programmatically load the measure_skill.py module for testing. This is used strictly for unit verification and relies on a path statically determined relative to the test file's own location.\n- [EXTERNAL_DOWNLOADS]: The skill mentions the tiktoken library for accurate token counting. This library is an industry-standard tool provided by OpenAI. The script includes logic to fall back to character-based estimates if the library is not installed, ensuring it does not fail unexpectedly.\n- [SAFE]: The file discovery mechanism in scripts/measure_skill.py implements security checks to prevent directory traversal. It ensures that any discovered reference files are relative to the skill's root directory and explicitly ignores absolute paths and remote URLs during its recursive search.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:52 AM