The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local command execution via Python's subprocess module for legitimate development tasks. This includes running the claude CLI for trigger evaluation in scripts/run_eval.py and using lsof to manage network ports for the local review server in eval-viewer/generate_review.py.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch authoritative technical documentation and API specifications from Alibaba Cloud's official help and API portals. It also utilizes the well-known SheetJS library from a public CDN to provide spreadsheet viewing capabilities in its reporting tool.
[OBFUSCATION]: The reporting tool employs Base64 encoding to embed output artifacts such as images and PDF files directly into a self-contained HTML report. This is a standard practice for generating portable documentation and does not hide malicious intent.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests external data from web documentation to guide the creation of new skill instructions. However, the workflow includes strict rules for summarizing content, citing sources, and human review of generated outputs, which mitigates the risk of blindly following embedded instructions.

aliyun-skill-creator