skill-creator
Warn
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule to invoke theclaudeCLI with dynamically generated queries and skill content. This is a core part of its evaluation and improvement cycle, found inscripts/run_eval.pyandscripts/improve_description.py.- [COMMAND_EXECUTION]: The execution scripts specifically remove theCLAUDECODEenvironment variable from the subprocess environment. This is designed to bypass security or recursion guards that typically prevent an agent from spawning another instance of itself.- [COMMAND_EXECUTION]: A local HTTP server is started on the loopback interface (127.0.0.1) to serve a web-based evaluation and benchmark viewer. This service is managed viaeval-viewer/generate_review.pyand automatically opens the user's browser.- [REMOTE_CODE_EXECUTION]: The skill implements a dynamic execution workflow where it generates and writes new command definitions to the.claude/commands/directory before executing them through CLI calls to test various skill iterations.
Audit Metadata