skill-creator

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFE
Full Analysis
  • [File System Scaffolding]: The init_skill.py script performs directory and file creation on the local filesystem to set up a new skill's structure. It uses standard pathlib operations to resolve paths and write templates, which is consistent with its role as an initialization tool.
  • [Permission Management]: The initialization script applies executable permissions (chmod 0o755) to a newly created example script. While this modifies file attributes, it is a standard step for preparing scripts that are intended for execution by the agent as part of a skill's functionality.
  • [Secure Metadata Parsing]: The quick_validate.py script uses the yaml.safe_load() function to process the frontmatter of skill files. This is a recommended security practice for handling configuration files, as it prevents the execution of arbitrary Python objects that can occur with unsafe YAML loading.
  • [Distribution Packaging]: The package_skill.py utility uses the built-in zipfile library to archive skill folders into a .skill format. This process facilitates the distribution of completed skills through standard compression techniques.
  • [Documentation and Best Practices]: The skill provides extensive guidance on 'Progressive Disclosure' and 'Degrees of Freedom,' encouraging developers to maintain lean contexts and establish clear boundaries between instructions, scripts, and references.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 09:17 PM