skill-factory

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The included validation script scripts/validate_skill.py checks for the presence of the pyyaml library and installs it from the official Python Package Index (PyPI) if it is missing. This is a standard and necessary operation for parsing skill frontmatter.
  • [COMMAND_EXECUTION]: The scripts/validate_skill.py script uses subprocess.check_call to perform the library installation mentioned above. The execution is handled safely by passing a list of arguments directly to the Python interpreter (sys.executable), avoiding shell injection risks.
  • [SAFE]: The skill incorporates documentation and instructions designed to improve the security and quality of other skills, including specific checks for hardcoded credentials and XML injection vectors.
  • [SAFE]: External references point exclusively to official Anthropic documentation and public GitHub repositories of well-known organizations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 11:31 AM
Security Audit — agent-trust-hub — skill-factory