The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The browser-based evaluation viewer (eval-viewer/viewer.html) loads the SheetJS library from cdn.sheetjs.com. This is a well-known service utilized for the legitimate purpose of rendering Excel file outputs within the user-facing review tool.
[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute system commands and interact with the claude CLI. Specifically, scripts/run_eval.py and scripts/improve_description.py call claude -p for description optimization and triggering tests, while eval-viewer/generate_review.py uses lsof to manage the local server port. These calls are implemented using list-based arguments to avoid shell injection and are appropriate for the skill's intended purpose as a developer utility.
[INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect prompt injection because it processes user-provided test prompts and skill descriptions.
Ingestion points: External data is ingested from evals/evals.json and user-defined skill descriptions.
Boundary markers: The description optimizer uses XML-style tags like <skill_content> and <current_description> to delimit different context blocks.
Capability inventory: The skill possesses capabilities for filesystem access, shell command execution via the claude CLI, and local network hosting via an HTTP server.
Sanitization: The skill relies on basic string processing and the underlying model's safety guardrails, which is typical for developer tools meant to process arbitrary task data.

custom-skill-creator