The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute the claude command-line interface. This occurs in scripts/run_eval.py to test skill triggering, and in scripts/improve_description.py to generate optimized skill descriptions. These operations are core to the skill's functionality for benchmarking and optimization.
[DYNAMIC_EXECUTION]: The skill dynamically generates content and configuration at runtime. scripts/run_eval.py creates temporary markdown command files in the .claude/commands/ directory to simulate available skills. Additionally, eval-viewer/generate_review.py constructs a self-contained HTML viewer by reading local workspace files and embedding them as Base64 data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided data, including test prompts and skill descriptions, which are then interpolated into prompts for the underlying AI model. In scripts/improve_description.py, failed query results and history are included in a prompt for the optimizer without explicit sanitization or strong boundary markers, creating a surface for indirect prompt injection.
Ingestion points: User-provided test prompts in evals/evals.json and skill metadata in SKILL.md.
Boundary markers: None observed in the prompt construction logic in scripts/improve_description.py.
Capability inventory: Subprocess execution of claude CLI, file writes to the workspace, and starting a local HTTP server.
Sanitization: No explicit sanitization or filtering of user-defined queries is performed before interpolation.
[EXTERNAL_DOWNLOADS]: The evaluation viewer template in eval-viewer/viewer.html fetches the SheetJS library from a well-known content delivery network (cdn.sheetjs.com) to enable spreadsheet rendering in the browser.

skill-creator