The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several Node.js scripts (e.g., scripts/aggregate-benchmark.js, eval-viewer/generate-review.js) designed to be executed via a JavaScript REPL or shell to manage the skill lifecycle, aggregate benchmarks, and generate HTML reports. These scripts interact with the local filesystem to process evaluation data and draft skill files.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface where it reads files from a project workspace (e.g., eval_metadata.json, grading.json, and outputs from skill runs) to generate review reports.
Ingestion points: The findRuns function in eval-viewer/generate-review.js recursively reads files from the outputs directory of a specified workspace.
Boundary markers: The skill instructions require the agent to capture user intent and explicitly confirm before publishing or deleting skills.
Capability inventory: The skill uses native host.skills methods for skill management and standard Node.js fs modules for local file operations.
Sanitization: The skill implements sanitization in scripts/utils.js via an escapeHtml function, uses textContent in eval-viewer/viewer.html for rendering file contents, and escapes JSON sequences in eval-viewer/generate-review.js to prevent script injection in generated HTML.
[SAFE]: The overall behavior of the skill is consistent with its stated purpose as a "Skill Creator." It uses platform-native tools for sensitive operations like publishing and deleting, and the included scripts are transparent utilities for development workflows.

skill-creator