skill-creator
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands through platform hooks and Python's subprocess module to perform project-related tasks.
scripts/verify.pyrunsgit statusandwagentsvalidation commands to ensure skill integrity and track changes.scripts/progress.pymanages a local state file and can serve a dashboard on localhost (127.0.0.1).- These executions are strictly scoped to the developer's local environment and are essential for the skill's documented functionality.
- [DYNAMIC_EXECUTION]: The
scripts/progress.pyscript utilizesimportlib.utilto dynamically load theaudit.pymodule at runtime. - This is used to integrate deterministic quality scoring into the progress tracking session. Since it loads a script that is part of the skill's own package, it does not pose a remote code execution risk.
- [DYNAMIC_CONTEXT_INJECTION]: The skill documentation refers to the platform's
!command`` syntax for body substitutions. - This feature is used within the skill to explain how to perform inline command execution for benign purposes, such as capturing command output for documentation, and does not contain malicious payloads.
Audit Metadata