skill-optimizer
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for using 'Skill_Seekers' (github.com/yusufkaraaslan/Skill_Seekers), an external third-party tool for scraping online documentation into reference files. The documentation clearly outlines this as an optional step for populating skill content.
- [COMMAND_EXECUTION]: Several utility scripts (run_eval.py, generate_review.py, package_skill.py) utilize subprocess calls to perform functional tasks such as executing evaluations via the 'claude' CLI, managing local ports via 'lsof', and zipping files for distribution. These operations are transparently documented and consistent with the skill's purpose as a development utility.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a factory for creating other skills, ingesting user requirements through an interview process and potentially scraping external documentation. While this creates a surface where untrusted data could influence generated content, the skill provides structured templates and validation scripts (quick_validate.py) to ensure the resulting outputs meet formatting and safety standards.
- [DYNAMIC_EXECUTION]: The evaluation framework (run_eval.py) dynamically generates temporary command files in the .claude/commands directory to test how the agent triggers on specific descriptions. This is a core feature used to systematically optimize trigger accuracy.
Audit Metadata