skill-bundle-curator

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/check.py file uses subprocess.run to execute internal validation scripts including validate_skill.py, validate_evals.py, and bundle_report.py. These commands are constructed using a list of arguments and target files within the local repository, which is a standard pattern for automated testing and auditing within a development environment.
  • [DATA_EXPOSURE]: The skill reads various configuration files such as agent-bundle.json, hook definitions in .cursor/hooks.json, and frontmatter from other skills and agents in the repository. This is the primary intended function of the tool and does not involve exfiltration to external services.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 06:15 AM
Security Audit — agent-trust-hub — skill-bundle-curator