The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts in the skill, such as run_eval.py, improve_description.py, and generate_review.py, use Python's subprocess module to execute system commands including claude and lsof. These calls are implemented safely without shell=True, passing arguments directly or via stdin to avoid command injection vulnerabilities.
[SAFE]: The skill employs safe parsing practices, notably using yaml.safe_load in quick_validate.py to handle skill frontmatter. The evaluation viewer served by generate_review.py is explicitly bound to 127.0.0.1, ensuring the review interface remains accessible only on the local machine.
[SAFE]: The skill includes explicit instructions and safety guidelines (e.g., in the 'Principle of Lack of Surprise' section) advising against the creation of malicious skills or unauthorized activities.

skill-creator