Versioned security assessment

Report ID: SA-9F814FC6

7/7/2026, 2:54:56 AM

skill-creator security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
skill-creator
Version
v1.3.0
Maintainer
Eric Andrade
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/skill-creator
Coverage
8 Files scanned · 1,688 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static command and network alerts are false positives from Markdown examples, placeholder URLs, or benign local validation code. Confirmed issues center on global symlink installation into hidden AI agent directories, missing skill-name path validation, and packaging behavior that may include unintended files.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

8 Files scanned · 1,688 Lines analyzed

23 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 21 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 95 evidence locations

Capability review items (20)
High
README.md:45
Hidden file in home directory
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
README.md:48
Hidden file in home directory
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
README.md:45
Symlink creation
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
README.md:48
Symlink creation
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:352
Hidden file in home directory
- [ ] **Global installation** - Create symlinks in `~/.copilot/skills/` (works everywhere)
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:552
Hidden file in home directory
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:384
Symlink creation
ln -sf "$SKILLS_REPO/.github/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:391
Symlink creation
ln -sf "$SKILLS_REPO/.claude/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:398
Symlink creation
ln -sf "$SKILLS_REPO/.codex/skills/$SKILL_NAME" \
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
High
SKILL.md:552
Symlink creation
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This global installation path writes a symlink into hidden AI tool skill directories under the user home directory. If run, it can replace an existing skill link and persist agent behavior across projects.
Medium
README.md:45
Hidden file access
ln -sf "$(pwd)/.github/skills/skill-creator" ~/.copilot/skills/skill-creator
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
README.md:48
Hidden file access
ln -sf "$(pwd)/.claude/skills/skill-creator" ~/.claude/skills/skill-creator
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:352
Hidden file access
- [ ] **Global installation** - Create symlinks in `~/.copilot/skills/` (works everywhere)
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:384
Hidden file access
ln -sf "$SKILLS_REPO/.github/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:385
Hidden file access
"$HOME/.copilot/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:391
Hidden file access
ln -sf "$SKILLS_REPO/.claude/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:392
Hidden file access
"$HOME/.claude/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:398
Hidden file access
ln -sf "$SKILLS_REPO/.codex/skills/$SKILL_NAME" \
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:399
Hidden file access
"$HOME/.codex/skills/$SKILL_NAME"
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.
Medium
SKILL.md:552
Hidden file access
- Always use absolute paths: `ln -sf /full/path/to/source ~/.copilot/skills/name`
This finding is part of the documented global installation flow that writes into hidden agent skill directories. The operation is user-directed, but it still modifies sensitive per-user agent configuration.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
scripts/init_skill.py:205-215scripts/init_skill.py:287-294SKILL.md:200-215
Unsanitized Skill Name Can Escape Target Directory
The initializer combines the requested path and skill name before creating directories and files, but it does not validate the skill name. A name containing path separators or an absolute path could write the generated skill outside the intended output directory.
The code and documented shell workflow derive filesystem paths from user-controlled skill names without enforcing the stated hyphen-case rules. The resulting operations create directories and write files.
RISK-002 Medium
SKILL.md:11SKILL.md:331-352SKILL.md:381-399
Misleading Safe Risk Metadata
The skill frontmatter declares risk as safe while the workflow supports global installation through symlinks in hidden agent directories. That mismatch can understate the review needed before installing a community skill.
The safe label is explicit in frontmatter, and later sections instruct global symlink installation into per-user agent configuration paths. The behavior is intentional but security-sensitive.
RISK-003 Medium
scripts/package_skill.py:70-74
Package Archive May Include Symlink Targets
The packaging script recursively writes every file found under the skill folder into an archive. It does not reject symlinks or filter unexpected files, which can leak outside file contents if a skill folder contains symlinked files.
Path.rglob combined with is_file can include symlinked files, and zipfile.write has no visible filter here. The risk depends on packaging a folder that already contains unsafe links or unrelated files.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Global installation writes symlinks into hidden agent skill directories.
    Require explicit confirmation, create target directories safely, refuse to overwrite existing links by default, and show the exact source and destination paths.
  2. FIX-002
    High
    Skill names are documented as hyphen-case but not enforced before filesystem writes.
    Validate skill names with a strict lowercase letters, digits, and hyphens pattern before building any path.
  3. FIX-003
    Medium
    The package script archives every file under the selected skill folder.
    Reject symlinks, skip hidden or secret-like files, and print a manifest for user approval before writing the archive.
  4. FIX-004
    Medium
    The skill declares risk as safe despite security-sensitive installation behavior.
    Update risk metadata and user-facing guidance to reflect filesystem writes, external commands, and global installation risks.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Content hash
0778035d586f0a329abe08713814e8566c51d1d9da0d1b4bd9081ad19b1b953d
Tree hash
891944eef0282053d37bfd987c18a1fb8d01f828995d350fddbe5dc75cc152be
Skill path
skills/sickn33/skill-creator
Audit payload hash
543dd67cb1b60f0a5e5f67a816cc57cc

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable