The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts 'run_eval.py', 'improve_description.py', and 'run_loop.py' utilize the Python 'subprocess' module to execute the 'claude' command-line interface. This allows the skill to programmatically trigger evaluation runs and perform automated description optimization. These calls are directed at the platform's native tool and are essential to the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill features a local evaluation viewer ('eval-viewer/generate_review.py') that ingests and renders output files created by agents during test runs. Because these agent-generated outputs are untrusted and rendered in a web browser ('viewer.html'), they represent a surface for indirect prompt injection or XSS. Specifically, the viewer uses 'innerHTML' when rendering spreadsheet data via the SheetJS library, which could be exploited if a malicious agent produces crafted output content. The system relies on local browser security and user oversight during the review process.
[EXTERNAL_DOWNLOADS]: The evaluation viewer's HTML template fetches the 'SheetJS' library from 'cdn.sheetjs.com' and typography assets from Google's font services. These are well-known technology services used for legitimate data visualization and UI purposes, posing no inherent threat to the user environment.

skill-creator