skill-creator

Pass

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module to run local utilities (aggregate_benchmark.py, run_loop.py, package_skill.py) and interacts with the claude CLI to perform trigger evaluations and automated benchmarks.
  • [COMMAND_EXECUTION]: The generate_review.py script executes system commands lsof and kill to manage the local network port (default 3117) required for its results viewer interface.
  • [EXTERNAL_DOWNLOADS]: The viewer.html template includes a reference to the SheetJS library hosted on a well-known CDN (cdn.sheetjs.com) to enable spreadsheet parsing and visualization in the browser-based review report.
  • [DATA_EXFILTRATION]: The skill starts a local HTTP server on the loopback interface (127.0.0.1) to serve evaluation data to the user for qualitative review. This server is private to the local machine and is used for its intended UI functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 13, 2026, 07:08 PM