The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.Popen in scripts/run_eval.py to execute the claude CLI for evaluation purposes. Technical analysis confirms the command is constructed as a list of arguments without shell=True, preventing shell injection vulnerabilities.
[DATA_EXPOSURE]: The eval-viewer/generate_review.py script initializes a local HTTP server bound strictly to 127.0.0.1 to host the evaluation results. This setup facilitates local review of generated outputs without exposing data to the network.
[EXTERNAL_DOWNLOADS]: The evaluation viewer template (eval-viewer/viewer.html) references the SheetJS library from a well-known CDN for rendering spreadsheet data. This is a standard practice for web-based data visualization tools.
[INDIRECT_PROMPT_INJECTION]: The optimization loop in scripts/improve_description.py ingests existing skill content and user queries to generate improved descriptions. The skill implements boundary markers (e.g., XML-style tags like <skill_content>) and YAML block scalars to isolate processed data and reduce the risk of instructions in the data influencing the generator.
[DYNAMIC_EXECUTION]: The skill dynamically generates temporary skill files in .claude/commands/ to test candidate descriptions against evaluation sets. This is a core functional requirement and is implemented with appropriate file cleanup and environment variable management.

skill-creator