The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's evaluation viewer (eval-viewer/viewer.html) loads the SheetJS library from https://cdn.sheetjs.com/ to support local Excel file rendering in the browser. This is a well-known service and the resource is used for legitimate visualization purposes.
[COMMAND_EXECUTION]: The skill orchestrates local development workflows by executing the claude CLI via subprocess to run automated test cases. It also uses standard system utilities like lsof and kill in eval-viewer/generate_review.py to manage local network ports when starting or stopping the results viewer.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and optimize prompts, creating an inherent ingestion surface for potentially untrusted data from test outputs and user feedback.
Ingestion points: Reads and processes feedback.json, evals/evals.json, and output logs from test runs to generate improved skill descriptions.
Boundary markers: The optimization script (scripts/improve_description.py) uses XML-style delimiters such as <current_description> and <skill_content> to separate untrusted data from instructions when communicating with the optimization model.
Capability inventory: The skill has the ability to write to the project directory, execute CLI tools, and host a local-only HTTP server restricted to 127.0.0.1.
Sanitization: The results viewer implements HTML escaping for rendered output content to prevent potential script injection during local review.

skill-creator