skill-creator
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- Standard Utilities (SAFE): The scripts
init_skill.py,package_skill.py, andquick_validate.pyperform routine file management tasks (directory creation, file writing, zipping) using Python'spathlibandzipfilemodules. These operations are local and lack any network communication capability. - Input Validation (SAFE):
quick_validate.pyimplements basic sanitization by checking for hyphen-case naming conventions and preventing angle brackets in descriptions. This helps ensure that the generated skill metadata remains structured and prevents common injection characters from entering the skill's manifest. - File Permissions (SAFE): The use of
chmod(0o755)ininit_skill.pyis restricted to the specific example script it creates, which is a standard and expected practice for making helper scripts executable within a skill environment. It does not attempt to modify permissions of existing system files. - No Remote Dependencies (SAFE): The scripts rely entirely on Python's standard library and local module imports, avoiding the risks associated with third-party package managers or remote code execution.
Audit Metadata