skill-creator

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess calls in scripts/run_eval.py and eval-viewer/generate_review.py to execute commands like claude -p and lsof. These calls are implemented using argument lists, mitigating shell injection risks, and are necessary for the skill's benchmarking and server management tasks.
  • [EXTERNAL_DOWNLOADS]: The skill identifies a dependency on the anthropic library for its AI-driven optimization features. This is a standard package from a well-known service provider.
  • [DATA_EXFILTRATION]: A local HTTP server is utilized by eval-viewer/generate_review.py to provide a visual interface for evaluation results. This server is bound to the loopback address (127.0.0.1) and is intended for local user review, posing no significant network risk.
  • [PROMPT_INJECTION]: Instructions within SKILL.md guide the user on crafting effective skill descriptions to ensure correct triggering. These are standard prompt engineering recommendations for skill development and do not contain malicious injection patterns aimed at bypassing agent constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 11:16 AM