Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent skill-building assistant that performs expected local evaluation and packaging work, with a few operational cautions but no evidence of deception or malicious behavior.
Install this only if you want an agent to help author and test skills. Expect it to create/edit skill files, spawn evaluation agents, run local Python/Claude CLI workflows, and open or generate review pages. Review generated skill descriptions for overly broad triggers and stop any launched viewer process when finished.
The skill explicitly tells authors to make descriptions 'pushy' so the skill activates even when the user does not clearly request it. This encourages overbroad triggering and can cause the agent to apply powerful file-editing, evaluation, or subprocess-running workflows in contexts where they are unnecessary or unintended, increasing the chance of unsafe or surprising actions.
The instruction to launch the viewer with 'nohup' backgrounds a long-lived process that persists beyond the immediate interaction. This creates session-persistence behavior and can leave orphaned services or files running if cleanup is missed, which may expose review artifacts or consume resources unexpectedly.
nohup python <skill-creator-path>/eval-viewer/generate_review.py \
<workspace>/iteration-N \
--skill-name "my-skill" \
--benchmark <workspace>/iteration-N/benchmark.json \
No suspicious patterns detected.