skill-creator

Warn

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module to invoke the claude CLI with dynamically generated queries and skill content. This is a core part of its evaluation and improvement cycle, found in scripts/run_eval.py and scripts/improve_description.py.- [COMMAND_EXECUTION]: The execution scripts specifically remove the CLAUDECODE environment variable from the subprocess environment. This is designed to bypass security or recursion guards that typically prevent an agent from spawning another instance of itself.- [COMMAND_EXECUTION]: A local HTTP server is started on the loopback interface (127.0.0.1) to serve a web-based evaluation and benchmark viewer. This service is managed via eval-viewer/generate_review.py and automatically opens the user's browser.- [REMOTE_CODE_EXECUTION]: The skill implements a dynamic execution workflow where it generates and writes new command definitions to the .claude/commands/ directory before executing them through CLI calls to test various skill iterations.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 18, 2026, 02:13 AM