skill-creator
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.Popenandsubprocess.runacross several scripts (run_eval.py,run_loop.py,package_skill.py) to execute theclaudeCLI and system tools likelsof. This is a core part of its functionality to automate the testing and optimization of skill descriptions. - [EXTERNAL_DOWNLOADS]: The
eval-viewerrenders an HTML page that loads theSheetJSlibrary fromcdn.sheetjs.com. This is used locally to allow the user to preview Excel files generated during skill testing. - [REMOTE_CODE_EXECUTION]: While the skill facilitates the execution of scripts within 'subagents' to test new skills, these are handled via the standard agent workflow. The
run_eval.pyscript programmatically invokes the localclaudeCLI to test triggering rates. - [DATA_EXFILTRATION]: The skill includes networking capabilities via
anthropicPython client to communicate with the LLM for description optimization. It also starts a local HTTP server (HTTPServer) to serve the evaluation results to the user's browser; this server is restricted to127.0.0.1.
Audit Metadata