skill-creator
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.Popeninscripts/run_eval.pyto invoke theclaudeCLI for trigger testing andsubprocess.runineval-viewer/generate_review.pyto manage local server ports usinglsof. These operations are functional requirements for its evaluation features. - [PROMPT_INJECTION]: The skill processes user-supplied test prompts which are then executed by subagents, representing a surface for indirect prompt injection. Ingestion points: Prompts are ingested from
evals/evals.json. Boundary markers: No explicit delimiters are used to wrap test prompts during execution. Capability inventory: Subagents used for testing have access to filesystem and terminal tools as defined by the skill being tested. Sanitization: No input validation is performed on test prompts. - [EXTERNAL_DOWNLOADS]: The evaluation viewer loads the SheetJS library from a well-known CDN (
cdn.sheetjs.com) to facilitate client-side rendering of spreadsheet files, which is a standard practice for this type of utility.
Audit Metadata