skill-creator
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: LOW
Full Analysis
- [COMMAND_EXECUTION] (LOW): The script
scripts/package-skill.tsexecutes the systemzipcommand viaBun.spawnSyncto bundle skill files. - Evidence:
Bun.spawnSync(["zip", "-r", skillFilename, skillName])inscripts/package-skill.ts. - Context: This is a standard functional requirement for a packaging utility and operates on local files provided by the developer.
- [EXTERNAL_DOWNLOADS] (INFO): The
package.jsonfile specifies a dependency on theyamlpackage. - Evidence:
"yaml": "^2.8.2"inpackage.json. - Context: The
yamlpackage is a standard, widely-used library for parsing YAML frontmatter and does not pose a security risk in this context.
Audit Metadata