The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses shell commands to manage its workflow, including cp -r for snapshotting skills, nohup and kill for managing background web server processes, and open to trigger system-level file opening in the browser.
[REMOTE_CODE_EXECUTION]: It executes several local Python modules and scripts (e.g., scripts.aggregate_benchmark, scripts.run_loop, scripts.package_skill, and generate_review.py) which represent the core logic of the skill creator. Additionally, it spawns subagents to execute task prompts provided in evals.json, which constitutes execution of arbitrary instructions.
[DATA_EXFILTRATION]: The skill is designed to read from the local filesystem to capture feedback and test results. It specifically monitors the ~/Downloads/ directory for eval_set.json files and creates workspace directories to store iteration data.
[PROMPT_INJECTION]: The instructions advise the agent to write "pushy" descriptions for new skills to manipulate and override the model's default triggering thresholds. It also explicitly permits "DAN" (Do Anything Now) style roleplay instructions in the skills it creates.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external data from feedback.json and evals.json without sanitization.
Ingestion points: Reads feedback from feedback.json and task prompts from evals.json (SKILL.md).
Boundary markers: None used to delimit untrusted data from instructions.
Capability inventory: Subprocess execution via Python, shell command execution, and subagent spawning.
Sanitization: No validation or escaping of the ingested JSON content before processing.

skill-creator