skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_eval.pyexecutes theclaudecommand-line interface viasubprocess.Popento perform skill evaluations. - [EXTERNAL_DOWNLOADS]: The
scripts/improve_description.pyscript uses the Anthropic Python SDK to communicate with the Anthropic API for generating and optimizing skill descriptions. - [EXTERNAL_DOWNLOADS]: The
eval-viewer/viewer.htmlfile loads the SheetJS library fromcdn.sheetjs.comto provide spreadsheet rendering capabilities within the evaluation viewer. - [COMMAND_EXECUTION]: The
eval-viewer/generate_review.pyscript usesos.killand thelsofcommand to manage local processes and ensure the viewer's HTTP server can bind to its designated port. - [PROMPT_INJECTION]: The skill processes untrusted input in the form of user-provided skill drafts and evaluation prompts. Ingestion points include
SKILL.md(viautils.py) andevals/evals.json. Capabilities include command execution through theclaudeCLI. Sanitization is performed viascripts/quick_validate.py, and the skill utilizes specialized sub-agents (agents/grader.md, etc.) with structured markdown headers as boundary markers to evaluate results.
Audit Metadata