skill-localization-packager

Pass

Audited by Gen Agent Trust Hub on Jul 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/check.py uses the subprocess.run function to invoke external validation scripts.
  • Evidence: It attempts to run validate_skill.py and validate_evals.py from a relative toolkit directory (../skill-creator/scripts/asset_toolkit/).
  • Context: The commands are executed using the current Python interpreter (sys.executable) and use path lists rather than shell strings, which is a secure practice for local development validation tools.- [SAFE]: The skill's metadata and instructions are consistent with its stated purpose as an internal development scaffold. There are no indications of prompt injection, data exfiltration, or obfuscation. All validation logic is directed at local environment paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 5, 2026, 02:05 AM
Security Audit — agent-trust-hub — skill-localization-packager