skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python's
subprocessmodule in several scripts (improve_description.py,run_eval.py,generate_review.py) to call theclaudeCLI and system utilities likelsof. This is the intended mechanism for running evaluations of other skills and managing the local visualization server. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
viewer.html) loads the SheetJS library fromcdn.sheetjs.comto enable the rendering of Excel files within the review interface. SheetJS is a well-known and established service for spreadsheet processing. - [DATA_EXFILTRATION]: No unauthorized network operations or credential harvesting patterns were identified. The local HTTP server started by
generate_review.pybinds to127.0.0.1, restricting access to the local machine. - [PROMPT_INJECTION]: The instructions focus on the operational workflow of skill development. While it provides guidance on writing effective skill descriptions to ensure proper triggering, it does not attempt to bypass safety filters or override the agent's core instructions.
Audit Metadata