skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFE
Full Analysis
- Local Visualization Server: The skill includes a utility,
generate_review.py, which starts a local HTTP server on127.0.0.1to host a web-based interface for reviewing evaluation results. This provides a user-friendly way to inspect complex benchmarking data within the local environment. - Subprocess Integration: The
run_eval.pyscript executes theclaudeCLI via subprocesses to test skill triggering accuracy. This is a functional requirement for the tool's automated description optimization features. - Dynamic Configuration Management: To verify how skills are recognized by the system, the skill writes and subsequently removes temporary files in the
.claude/commands/directory. This allows the tool to test triggering logic during its optimization loop without permanently modifying the user's configuration. - Indirect Prompt Injection Surface: The skill processes and grades content generated from user-provided prompts. This creates a surface where instructions embedded in test data could potentially influence the behavior of the grader or analyzer subagents. The skill manages this by using structured data formats (JSON) and clear section delimiters in its transcripts.
- Automated Skill Packaging: The
package_skill.pyscript automates the creation of.skillfiles (standard zip archives) for distribution. This supports the intended workflow of developing and then packaging functional agent skills for use.
Audit Metadata