skills/gyuha/skills/skill-creator/Gen Agent Trust Hub

skill-creator

Fail

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run_eval.py uses subprocess.Popen to execute the claude CLI tool, passing user-supplied query strings directly as command-line arguments to test triggering behavior.
  • [COMMAND_EXECUTION]: The utility eval-viewer/generate_review.py executes system commands lsof and kill via subprocess.run to manage processes listening on local network ports.
  • [REMOTE_CODE_EXECUTION]: The skill implements an iterative optimization cycle in scripts/run_loop.py that generates new skill instructions (executable prompts) using an LLM and then executes them in the local environment to evaluate their effectiveness.
  • [DATA_EXPOSURE]: The script eval-viewer/generate_review.py recursively reads files from the workspace directory and encodes them into Base64 for embedding within an HTML review report.
  • [COMMAND_EXECUTION]: The scripts/run_eval.py script writes temporary markdown files to the .claude/commands/ directory to dynamically inject and test new agent capabilities.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 10, 2026, 04:52 AM