skill-compressor

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The testing script scripts/test_measure_skill.py uses subprocess.check_output to verify the CLI functionality of scripts/measure_skill.py. This execution is restricted to invoking the skill's own local scripts for testing purposes and does not represent an arbitrary code execution risk.
  • [EXTERNAL_DOWNLOADS]: The scripts/measure_skill.py utility attempts to load the tiktoken library to provide high-fidelity token counting. tiktoken is a standard, widely-used package from a well-known service, and the script handles its absence gracefully.
  • [DYNAMIC_EXECUTION]: The test suite uses importlib to dynamically load and execute the local measure_skill.py script. This is a standard practice in Python unit testing for modular verification of local files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 06:52 AM
Security Audit — agent-trust-hub — skill-compressor