skills/iyaki/ralph/skill-creator/Gen Agent Trust Hub

skill-creator

Pass

Audited by Gen Agent Trust Hub on Apr 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module in run_eval.py, improve_description.py, and run_loop.py to execute the claude CLI and other local scripts. This is core functionality for automating the testing and improvement of other skills. The commands are constructed using lists rather than shell strings, following security best practices to avoid command injection.
  • [EXTERNAL_DOWNLOADS]: The evaluation viewer (viewer.html) references the SheetJS library from cdn.sheetjs.com and web fonts from fonts.googleapis.com. These are well-known technology services used solely for browser-side rendering of evaluation results and do not involve runtime execution of untrusted code within the agent's primary process.
  • [COMMAND_EXECUTION]: The generate_review.py script executes system utilities lsof and kill to manage the local HTTP server used for the browser-based review interface. These operations are restricted to the local environment and are intended for session management.
  • [SAFE]: The skill implements structured data delimiters (such as XML-style tags) when interpolating skill content into optimization prompts, reducing the risk of accidental prompt injection from the skill data being processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 17, 2026, 12:15 AM