skill-creator

Pass

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: LOW
Full Analysis
  • Standard Utilities (SAFE): The scripts init_skill.py, package_skill.py, and quick_validate.py perform routine file management tasks (directory creation, file writing, zipping) using Python's pathlib and zipfile modules. These operations are local and lack any network communication capability.
  • Input Validation (SAFE): quick_validate.py implements basic sanitization by checking for hyphen-case naming conventions and preventing angle brackets in descriptions. This helps ensure that the generated skill metadata remains structured and prevents common injection characters from entering the skill's manifest.
  • File Permissions (SAFE): The use of chmod(0o755) in init_skill.py is restricted to the specific example script it creates, which is a standard and expected practice for making helper scripts executable within a skill environment. It does not attempt to modify permissions of existing system files.
  • No Remote Dependencies (SAFE): The scripts rely entirely on Python's standard library and local module imports, avoiding the risks associated with third-party package managers or remote code execution.
Audit Metadata
Risk Level
LOW
Analyzed
Feb 16, 2026, 12:45 PM