skill-creator
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The initialization tool generates boilerplate files and sets their permissions to be executable by the user.
- Evidence: The
scripts/init_skill.pyscript applieschmod(0o755)to the newly createdscripts/example.pyto facilitate direct execution of the template code. - [SAFE]: The skill utilizes secure parsing methods for configuration files to prevent arbitrary code execution during validation.
- Evidence:
scripts/quick_validate.pyspecifically usesyaml.safe_load()to process the YAML frontmatter of skills. - [SAFE]: Filesystem interactions are implemented using secure path resolution techniques to mitigate path traversal risks.
- Evidence: The scripts utilize the
pathlibmodule'sresolve()method inscripts/init_skill.pyandscripts/package_skill.pywhen determining target directories for skill creation and packaging.
Audit Metadata