skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python
subprocessmodule inscripts/platforms/claude_code.py,codex.py, andopenclaw.pyto execute agent CLI tools for trigger evaluation and benchmarking. This behavior is central to the skill's function and includes security measures like sandboxing where supported by the underlying platform. - [COMMAND_EXECUTION]: Additional subprocess calls in
scripts/run_loop.pyandscripts/improve_description.pyfacilitate the automated optimization of skill descriptions by calling optimizer runtimes. - [COMMAND_EXECUTION]: The
eval-viewer/generate_review.pyscript uses shell commands to manage the lifecycle of the local evaluation viewer server and ensure ports are properly cleared. - [DATA_EXFILTRATION]: The
eval-viewercomponent reads local workspace files and embeds them as Base64 data URIs in a local HTML file for review. This constitutes a data exposure surface for files within the project workspace, which is necessary for the qualitative review step of the development loop.
Audit Metadata