skills-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a meta-documentation guide for developers, providing templates and instructions for creating agent skills. No malicious instructions or safety bypasses were found.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and resources from trusted domains, including agentskills.io, anthropic.com, and the official anthropics GitHub organization. These references are used for educational purposes and do not involve untrusted remote code execution.
- [COMMAND_EXECUTION]: Includes examples of local script execution (e.g.,
python scripts/analyze.py) and standard developer tools (e.g.,gh pr diff) within workflow patterns. These are documented as best practices for task-specific automation and do not exhibit dangerous or unauthorized execution patterns. - [DYNAMIC_CONTEXT_INJECTION]: Documents the dynamic context injection syntax (
!command) available in specific agent platforms. The usage is strictly instructional, providing benign examples for developer workflows such as pull request analysis. - [DATA_EXPOSURE_AND_EXFILTRATION]: No hardcoded credentials, sensitive file access, or suspicious network operations were detected. Mentions of sensitive files like
.envare made in the context of standard configuration practices rather than unauthorized access.
Audit Metadata