The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module in several scripts (scripts/run_eval.py, scripts/improve_description.py, eval-viewer/generate_review.py) to automate workflows.
These calls are used to execute the claude CLI for evaluation tasks, manage ports for the viewer, and run internal helper scripts.
The analysis confirms these are standard operational tasks for a development tool and do not involve unsanitized user input or arbitrary command injection.
[REMOTE_CODE_EXECUTION]: The skill mentions external dependencies (SheetJS) via a CDN in the HTML viewer.
This is a well-known library used for rendering spreadsheets in the eval-viewer UI and does not present a remote code execution risk in this context.
[FRONTMATTER_ANALYSIS]: The YAML frontmatter in SKILL.md is correctly structured and provides clear metadata for triggering. It does not contain any prompt injection or bypass attempts.
[PERSISTENCE_MECHANISMS]: No attempts to modify shell profiles, cron jobs, or startup services were found. The skill only writes to project-specific workspaces.

skill-creator