skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The package_skill.cjs script uses the system zip command to bundle files into a distributable skill package. This is a standard and necessary build operation for this utility.
- [COMMAND_EXECUTION]: The init_skill.cjs script assigns execution permissions (0o755) to a template script, which is standard practice for creating executable development tools.
- [PROMPT_INJECTION]: The skill's primary function involves generating new skill files based on user-provided descriptions and instructions, which naturally creates an indirect prompt injection surface. This behavior is expected for a template generator and involves only local file system operations.
Audit Metadata