The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates the claude CLI via the subprocess module to perform evaluations and optimize skill metadata. These calls utilize argument arrays, ensuring that user-provided strings (such as evaluation prompts) are handled as data rather than shell commands, effectively preventing command injection vulnerabilities.
[DATA_EXPOSURE]: The generate_review.py script starts a local HTTP server using the Python standard library to display evaluation results. The server binds exclusively to the loopback interface (127.0.0.1), ensuring that the workspace data and agent outputs are only accessible from the local host.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data, including test prompts and agent-generated outputs, as part of its core evaluation workflow.
Ingestion points: User-defined prompts in evals/evals.json and files generated during execution stored in the workspace.
Boundary markers: The subagent templates in agents/grader.md and agents/comparator.md use structured markdown formats to isolate instructions from the data being processed.
Capability inventory: The skill can perform file system operations (read/write), execute the claude CLI, and run a local visualization server.
Sanitization: The evaluation viewer implements HTML escaping to prevent cross-site scripting (XSS) when rendering agent outputs in a web browser.
[EXTERNAL_DOWNLOADS]: The evaluation viewer interface (viewer.html) references the SheetJS library from a public CDN to enable the rendering of spreadsheet files. This is a common and legitimate practice for data visualization tools.

skill-creator