skill-creator

Pass

Audited by Gen Agent Trust Hub on Mar 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The package_skill.cjs script uses the system zip command to bundle files into a distributable skill package. This is a standard and necessary build operation for this utility.
  • [COMMAND_EXECUTION]: The init_skill.cjs script assigns execution permissions (0o755) to a template script, which is standard practice for creating executable development tools.
  • [PROMPT_INJECTION]: The skill's primary function involves generating new skill files based on user-provided descriptions and instructions, which naturally creates an indirect prompt injection surface. This behavior is expected for a template generator and involves only local file system operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 28, 2026, 08:18 PM