skill-creator
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python and Bash scripts (e.g.,
init_skill.py,quick_validate.py,bootstrap-skill.sh) to manage the lifecycle of agent skills. These scripts are used for scaffolding new skills, validating their structure, and registering them in a local registry. - [EXTERNAL_DOWNLOADS]: The skill provides mechanisms to import external skills from upstream sources using a local bootstrap script. It also references official GitHub Copilot services in its documentation examples, which are well-known developer services.
- [SAFE]: The skill incorporates security best practices, including the use of
yaml.safe_load()to prevent unsafe deserialization during configuration parsing. Additionally, it implements input normalization using regular expressions to sanitize skill names, which prevents potential path traversal or invalid filename issues during the scaffolding process.
Audit Metadata