The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple Python scripts within the skill (scripts/run_eval.py, scripts/improve_description.py, and eval-viewer/generate_review.py) use the subprocess module to execute system commands. Specifically, the skill invokes the claude CLI to run evaluations and lsof to manage network ports. While these calls use argument lists (minimizing shell injection risk), they grant the skill significant control over the local command-line environment.
[DATA_EXFILTRATION]: The eval-viewer/generate_review.py script initializes a local web server (HTTPServer) bound to 127.0.0.1. This server is used to host an evaluation viewer that reads files from a user-specified workspace directory, encodes them into Base64, and embeds them into an HTML page for display. This creates a data exposure surface where local files in the workspace are accessible via the local web server.
[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection (Category 8) as it is designed to ingest and evaluate the behavior of other agent skills which may contain malicious instructions.
Ingestion points: The agents/grader.md subagent and the scripts/improve_description.py script read and process output transcripts and skill code generated during the development process.
Boundary markers: The skill uses basic XML-like tags (e.g., <skill_content>, <current_description>) to delimit ingested content, but lacks robust instructions to ignore or neutralize potentially malicious directives within that data.
Capability inventory: The skill possesses capabilities for shell execution (via claude -p) and filesystem modification (writing to .claude/commands/), which could be targeted by an injection attack.
Sanitization: There is no evidence of filtering or escaping logic to sanitize external content before it is interpolated into prompts or written to configuration files.

skill-creator