skill-creator
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
claudeCLI using Python'ssubprocessmodule to run evaluation queries (scripts/run_eval.py) and perform description optimization (scripts/improve_description.py). It also usessubprocessto manage local network ports via thelsofutility in the review server. These operations are restricted to the local environment and are necessary for the skill's primary function as a development tool. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
eval-viewer/viewer.html) loads the SheetJS library from a public CDN (cdn.sheetjs.com). This is a well-known service used here to enable the rendering of spreadsheet files within the browser-based review interface. - [DATA_EXFILTRATION]: The
eval-viewer/generate_review.pyscript initializes a local HTTP server. To ensure security, the server is explicitly bound to the loopback interface (127.0.0.1), preventing external access to the evaluation workspace. - [DYNAMIC_CODE_EXECUTION]: The skill generates and modifies skill definitions (YAML frontmatter and markdown instructions) at runtime. These generated artifacts are then executed by the agent platform during the testing and optimization phases, which is the intended behavior of a skill-generation meta-tool.
Audit Metadata