The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess in scripts/run_eval.py and scripts/improve_description.py to call the claude CLI. This is a core functionality designed to test skill triggering and evaluate performance in a sandbox-like manner.
[EXTERNAL_DOWNLOADS]: The eval-viewer/viewer.html file includes a script tag for cdn.sheetjs.com to enable Excel file rendering within the local evaluation viewer. This targets a well-known service and is used for data visualization.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates an optimization loop where user-provided skill descriptions and test prompts are processed by an LLM. Scripts such as improve_description.py use XML-style tags and indentation to separate these external inputs from system instructions. While this represents an attack surface for indirect prompt injection, it is managed with standard delimiters.
[DATA_EXPOSURE]: The eval-viewer/generate_review.py script implements a local HTTP server on localhost to display test outputs. It reads files from the designated workspace and embeds them into HTML. The script includes protections such as excluding sensitive directories (e.g., .git, node_modules) and only processing directories that contain a specific outputs/ subdirectory.

skill-creator