skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule across multiple utility scripts to execute system commands and external tools. scripts/run_eval.pyandscripts/run_loop.pyexecute theclaudeCLI to test generated skills and optimize descriptions.eval-viewer/generate_review.pyexecuteslsofandkillto manage the local web server port for the evaluation viewer.scripts/package_skill.pyexecutespythonto run validation scripts before bundling skills into.skillfiles.- [EXTERNAL_DOWNLOADS]: The
eval-viewer/viewer.htmlfile includes a script reference tocdn.sheetjs.comto load the SheetJS library, which is used to render Excel (.xlsx) files within the evaluation report. This is a well-known service for client-side spreadsheet processing. - [DATA_EXPOSURE]: The
eval-viewer/generate_review.pyscript reads the contents of output files from test runs and embeds them as Base64-encoded strings into a self-contained HTML file. This behavior is necessary for the skill's primary function of facilitating human review of generated content.
Audit Metadata