skill-creator

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands through platform hooks and Python's subprocess module to perform project-related tasks.
  • scripts/verify.py runs git status and wagents validation commands to ensure skill integrity and track changes.
  • scripts/progress.py manages a local state file and can serve a dashboard on localhost (127.0.0.1).
  • These executions are strictly scoped to the developer's local environment and are essential for the skill's documented functionality.
  • [DYNAMIC_EXECUTION]: The scripts/progress.py script utilizes importlib.util to dynamically load the audit.py module at runtime.
  • This is used to integrate deterministic quality scoring into the progress tracking session. Since it loads a script that is part of the skill's own package, it does not pose a remote code execution risk.
  • [DYNAMIC_CONTEXT_INJECTION]: The skill documentation refers to the platform's !command`` syntax for body substitutions.
  • This feature is used within the skill to explain how to perform inline command execution for benign purposes, such as capturing command output for documentation, and does not contain malicious payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 08:00 AM