skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule inrun_eval.py,improve_description.py, andrun_loop.pyto execute theclaudeCLI and other local scripts. This is core functionality for automating the testing and improvement of other skills. The commands are constructed using lists rather than shell strings, following security best practices to avoid command injection. - [EXTERNAL_DOWNLOADS]: The evaluation viewer (
viewer.html) references the SheetJS library fromcdn.sheetjs.comand web fonts fromfonts.googleapis.com. These are well-known technology services used solely for browser-side rendering of evaluation results and do not involve runtime execution of untrusted code within the agent's primary process. - [COMMAND_EXECUTION]: The
generate_review.pyscript executes system utilitieslsofandkillto manage the local HTTP server used for the browser-based review interface. These operations are restricted to the local environment and are intended for session management. - [SAFE]: The skill implements structured data delimiters (such as XML-style tags) when interpolating skill content into optimization prompts, reducing the risk of accidental prompt injection from the skill data being processed.
Audit Metadata