The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and subprocess.Popen in several scripts (improve_description.py, run_eval.py, generate_review.py) to execute system commands. These are used for legitimate skill development tasks: calling the claude CLI for evaluation and optimization, managing local server ports, and running user-defined validation scripts.
[REMOTE_CODE_EXECUTION]: While the skill can execute user-defined scripts, it does not download or execute code from untrusted remote sources. It provides explicit warnings in SKILL.md to avoid creating skills that facilitate unauthorized access or data exfiltration.
[DATA_EXPOSURE]: The skill accesses local project files (such as .claude/commands/) to manage temporary skill definitions for testing. This is standard behavior for a development tool and does not involve exfiltration of sensitive credentials.

skill-creator