zach-seller-skill-creator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.Popeninscripts/run_eval.pyto invoke theclaudeCLI for automated trigger testing. Theeval-viewer/generate_review.pyscript also usessubprocess.runto executelsofandkillcommands for local port management during the serving of review pages.- [DYNAMIC_EXECUTION]: The toolkit dynamically constructs temporary markdown files in the project's.claude/commands/directory to simulate skill environments during evaluation cycles. It also performs runtime rendering of spreadsheet data in the browser using the SheetJS library.- [INDIRECT_PROMPT_INJECTION]: The workflow ingests user-provided business context and test prompts which are then processed by sub-agents for grading and analysis. The skill mitigates risks associated with untrusted data by implementing a mandatory '6-question gate' that enforces specific validation and quality standards before data is accepted into the agent's context.- [EXTERNAL_DOWNLOADS]: Theeval-viewer/viewer.htmlcomponent references the SheetJS library from an external CDN (cdn.sheetjs.com) to enable spreadsheet visualization for the user during the evaluation review process.
Audit Metadata