skill-token-budget-linter
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check.pyusessubprocess.runto invoke other Python scripts within the skill's own directory structure (e.g.,lint_budget.py,validate_skill.py). This is standard behavior for a linter and validator tool and does not involve untrusted input or shell injection risks. - [SAFE_PRACTICE]: The skill implements strict static analysis of token budgets and uses
yaml.safe_loadfor parsing frontmatter, which is a security best practice for handling YAML content.
Audit Metadata