skill-creator

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFE
Full Analysis
  • Local Visualization Server: The skill includes a utility, generate_review.py, which starts a local HTTP server on 127.0.0.1 to host a web-based interface for reviewing evaluation results. This provides a user-friendly way to inspect complex benchmarking data within the local environment.
  • Subprocess Integration: The run_eval.py script executes the claude CLI via subprocesses to test skill triggering accuracy. This is a functional requirement for the tool's automated description optimization features.
  • Dynamic Configuration Management: To verify how skills are recognized by the system, the skill writes and subsequently removes temporary files in the .claude/commands/ directory. This allows the tool to test triggering logic during its optimization loop without permanently modifying the user's configuration.
  • Indirect Prompt Injection Surface: The skill processes and grades content generated from user-provided prompts. This creates a surface where instructions embedded in test data could potentially influence the behavior of the grader or analyzer subagents. The skill manages this by using structured data formats (JSON) and clear section delimiters in its transcripts.
  • Automated Skill Packaging: The package_skill.py script automates the creation of .skill files (standard zip archives) for distribution. This supports the intended workflow of developing and then packaging functional agent skills for use.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 07:58 AM