skill-creator
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule in scripts likerun_eval.pyandrun_loop.pyto execute theclaudeCLI and other local utility scripts. This is necessary for its core functionality of automating skill testing. - [EXTERNAL_DOWNLOADS]: The skill interacts with the Anthropic API (a trusted vendor) via the
anthropicPython package. Additionally, the evaluation viewer loads the SheetJS library from a well-known CDN (cdn.sheetjs.com) to render spreadsheets. - [PROMPT_INJECTION]: The
agents/grader.mdsubagent processes data generated by other skills during testing. While this presents an indirect prompt injection surface, it is a functional requirement of the evaluation process, and the skill includes human review steps in its workflow to mitigate automated decision risks.
Audit Metadata