alicloud-skill-creator

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with the local system and the Claude CLI using Python's subprocess module to perform its core engineering tasks.
  • scripts/run_eval.py and scripts/run_loop.py execute the claude command-line interface to evaluate how effectively skill descriptions trigger the agent.
  • eval-viewer/generate_review.py executes the lsof utility to manage local network ports when starting the evaluation viewer server.
  • The workflow instructions in SKILL.md prompt the execution of repository-specific scripts such as scripts/update_skill_index.sh and tests/common/compile_skill_scripts.py.
  • [EXTERNAL_DOWNLOADS]: The skill's HTML assets reference external resources from well-known technology providers to enhance the evaluation viewer's functionality.
  • assets/eval_review.html and eval-viewer/viewer.html load font styles from Google Fonts (fonts.googleapis.com).
  • eval-viewer/viewer.html fetches the SheetJS library from cdn.sheetjs.com to support the rendering of spreadsheet data within the viewer.
  • [REMOTE_CODE_EXECUTION]: The skill implements an automated optimization loop that relies on communication with an external AI service.
  • scripts/improve_description.py uses the Anthropic Python SDK to send current skill metadata to a remote model, which then generates improved versions of the description.
  • [DATA_EXFILTRATION]: As part of its intended optimization workflow, the skill transmits internal file content to a remote API.
  • scripts/improve_description.py sends the full text of SKILL.md files to the Anthropic API to facilitate description refinement. This is a functional requirement for the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 10:14 AM