skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill serves as a legitimate framework for skill development, consisting of markdown documentation and local Python utility scripts.- [COMMAND_EXECUTION]: The skill includes local scripts
scripts/init_skill.pyandscripts/package_skill.pyto automate file system tasks: init_skill.py: Creates directory structures and template files based on user-provided names.package_skill.py: Bundles skill directories into ZIP archives using the standardzipfilelibrary.- These scripts operate strictly on the local file system and do not perform network requests.- [INDIRECT_PROMPT_INJECTION]: The skill functions as a template generator that incorporates user-provided metadata (name, description) into generated files.
- Ingestion points: User-supplied arguments to the
init_skill.pycommand-line interface. - Boundary markers: None explicitly defined in the templates, though content is separated into distinct files.
- Capability inventory: File system write access and permission modification (
chmod 755) for generated example scripts inscripts/init_skill.py. - Sanitization:
scripts/quick_validate.pyprovides validation logic that enforces hyphen-case naming conventions and restricts the use of angle brackets in descriptions to mitigate basic injection risks.
Audit Metadata