skill-factory
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The included validation script
scripts/validate_skill.pychecks for the presence of thepyyamllibrary and installs it from the official Python Package Index (PyPI) if it is missing. This is a standard and necessary operation for parsing skill frontmatter. - [COMMAND_EXECUTION]: The
scripts/validate_skill.pyscript usessubprocess.check_callto perform the library installation mentioned above. The execution is handled safely by passing a list of arguments directly to the Python interpreter (sys.executable), avoiding shell injection risks. - [SAFE]: The skill incorporates documentation and instructions designed to improve the security and quality of other skills, including specific checks for hardcoded credentials and XML injection vectors.
- [SAFE]: External references point exclusively to official Anthropic documentation and public GitHub repositories of well-known organizations.
Audit Metadata