The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to automate evaluation loops and benchmarking. It executes local Python scripts (scripts/run_loop.py, scripts.aggregate_benchmark) and manages a local HTTP server process using tools like nohup, kill, and lsof to ensure port availability.
[DYNAMIC_EXECUTION]: The skill orchestrates tasks by spawning subagents for automated testing and comparative analysis. It programmatically generates temporary skill configuration files in .claude/commands/ and invokes the claude CLI to verify triggering logic during optimization loops.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted test prompts and user-defined skill content, which are then passed to subagents for execution and grading.
Ingestion points: Reads evals/evals.json and external skill directories provided by the user to populate test scenarios.
Boundary markers: While the instructions contain a 'Principle of Lack of Surprise' section regarding malware, there are no technical sanitization or delimiting mechanisms for user-supplied content before it is interpolated into subagent prompts.
Capability inventory: High-level capabilities including subagent spawning, local shell execution via the subprocess module, and direct file system manipulation.
Sanitization: No explicit sanitization or escaping of user-provided prompt strings or skill bodies is performed before they are executed in subagent environments.
[EXTERNAL_DOWNLOADS]: The integrated review viewer (eval-viewer/viewer.html) fetches the SheetJS library from a well-known CDN (cdn.sheetjs.com) to support the rendering of spreadsheet files within the browser interface.

skill-creator