develop-agent-skills
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches official documentation from Anthropic's verified domain (code.claude.com) and can download skill archives from GitHub when requested by the user. These sources are categorized as well-known and trusted.
- [COMMAND_EXECUTION]: The
skillutilutility executes the systemtarcommand to extract downloaded skill archives. This is a restricted operation used solely for the installation and forking of skill packages. - [SAFE]: The tool implements strict validation for skill names (lowercase alphanumeric and hyphens only, length limits) to prevent path traversal or injection during file creation.
- [SAFE]: New skill generation relies on pre-defined templates and safe string interpolation, ensuring that generated boilerplate code is predictable and follows best practices.
Audit Metadata