The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module to call the claude CLI and the lsof utility. These calls automate evaluations and manage the local review server. Analysis shows that these commands use list-based arguments without a shell, which prevents shell command injection.
[INDIRECT_PROMPT_INJECTION]: As a tool that processes skill definitions, user feedback, and benchmark results, the skill has an inherent surface for indirect prompt injection. Malicious instructions in a skill being optimized could potentially influence the 'description improver'. The skill mitigates this using XML-style boundary markers (e.g., <skill_content>) to isolate untrusted data.
[DYNAMIC_CONTEXT_INJECTION]: The skill scripts create temporary .md command files in the .claude/commands/ directory to test triggering logic. These files are ephemeral and are deleted immediately after the evaluation run, following standard platform automation patterns.
[SAFE]: The local HTTP server started for result review is bound to the loopback address (127.0.0.1), ensuring it is only accessible from the local machine. It references the well-known SheetJS library from a public CDN to render spreadsheets, which is a safe and common practice.

skill-creator