Skills skill-creator
📦
skill-creator
Content revision r2 High Risk 📁 Filesystem access⚡ Contains scripts⚙️ External commands🌐 Network access🔑 Env variables
Build and Evaluate AI Skills
Skill development often lacks repeatable testing and evidence. This skill guides drafting, evaluation, benchmarking, revision, trigger optimization, and packaging.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "skill-creator" from https://skillstore.io/skills/davila7-skill-development.md and its manifest at https://skillstore.io/api/skills/davila7-skill-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "skill-creator". Create a skill that converts interview notes into structured research summaries.
Expected outcome:
A skill draft with trigger guidance, a focused workflow, expected output sections, edge-case handling, and three realistic evaluation prompts.
Using "skill-creator". Compare my revised spreadsheet skill against its original version.
Expected outcome:
- A benchmark summary comparing pass rate, execution time, and token use.
- A review page showing both output sets, formal grades, and feedback controls.
- Revision recommendations tied to repeated failures and transcript evidence.
Using "skill-creator". Improve when my deployment skill activates, without causing unrelated triggers.
Expected outcome:
A balanced trigger test set, measured train and holdout results, and a concise description selected from evaluated alternatives.
Security Audit
High Riskv9 • 7/23/2026 Open versioned report
Most findings are scanner false positives caused by Markdown backticks, CSS borders, JavaScript template literals, loopback networking, and ordinary key enumeration. Confirmed risks include unsandboxed nested Claude execution, inherited secrets, forced port termination, browser injection paths, unsafe symlink handling, and shared temporary files. Publication should wait until high-impact execution, XSS, and file disclosure issues are fixed.
18
Files scanned
5,680
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Untrusted Content Reaches Tool-Capable Nested Agents
Skill content and raw evaluation queries are sent to Claude CLI without an explicit tool denylist. Prompt injection can influence nested agent actions.
Both paths directly interpolate untrusted text and launch Claude CLI. Neither command constrains tools or supplies a minimal environment.
High
Embedded Review Data Can Break Out of Script Context
Serialized run data is inserted directly into a script element. Output containing a closing script tag can inject active HTML or JavaScript.
json.dumps does not escape the HTML closing-script sequence. The resulting string is inserted verbatim inside the template's script element.
High
Raw Template Placeholders Permit HTML Injection
The workflow replaces skill name, description, and evaluation data placeholders without requiring HTML or script-context escaping.
The placeholders occupy raw HTML and JavaScript contexts, while the replacement instructions require direct substitution and specify no escaping.
High
eval-viewer/generate_review.py:121-127eval-viewer/generate_review.py:149-202scripts/package_skill.py:93-100
Symlink Following Can Disclose Files
Viewer generation and packaging follow files found below user-selected directories. Symlinks can include files outside the intended workspace or skill root.
Path.is_file and the subsequent read or archive operation follow symlinks. No resolved-path containment check rejects targets outside the selected root.
Medium
Skill Name Is Used in a Filesystem Path Without Validation
A skill name from frontmatter becomes part of a command filename. Path separators can escape the intended commands directory.
The name is concatenated into a Path without a slug check or basename normalization. The file is later written and unlinked.
Medium
Evaluation Artifacts Are Not Marked as Untrusted Data
The grader reads transcripts and output files without instructions to ignore embedded commands. Adversarial outputs can manipulate grading or request unrelated tool actions.
The grader is explicitly directed to read arbitrary artifacts but receives no prompt-injection boundary. Exploitability depends on the hosting agent's tool permissions.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(
The subprocess runs lsof, then line 298 terminates every returned PID for the selected port. A user-selected port can therefore stop an unrelated local service without confirmation.
High
innerHTML assignment (XSS risk)
wrapper.innerHTML = htmlStr;
SheetJS converts workbook content to an HTML string that is assigned to innerHTML. A crafted workbook may place active markup into the local review page unless the generated HTML is sanitized.
High
innerHTML assignment (XSS risk)
container.innerHTML = html;
The benchmark HTML includes several unescaped metadata and configuration values before assignment to innerHTML. A modified benchmark file can inject markup into the review page.
High
Python subprocess.run
result = subprocess.run(
This launches Claude with a prompt containing untrusted skill content and does not disable agent tools. Prompt injection in the reviewed skill can influence the nested agent beyond description rewriting.
High
Python subprocess.Popen
process = subprocess.Popen(
This launches Claude on raw evaluation queries with inherited credentials and no explicit tool restriction. A malicious query can request tool actions before the harness terminates the process.
Medium
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
The nested Claude process inherits every environment variable except CLAUDECODE. This unnecessarily exposes unrelated credentials to a process handling untrusted skill content.
Medium
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
Each evaluation subprocess inherits the complete environment except CLAUDECODE. Raw test prompts therefore run in a process that can access unrelated environment secrets.
Medium
Ruby/shell backtick execution
- **Improving an existing skill**: the old version. Before editing, snapshot the skill (`cp -r <skil
The documented cp command contains unquoted skill and workspace placeholders. Replacing them with a path containing shell metacharacters can alter the command.
Medium
Ruby/shell backtick execution
```bash
The enclosed shell command passes unquoted workspace and name placeholders. Agent substitution of untrusted path text can cause shell parsing or command injection.
Medium
Ruby/shell backtick execution
```bash
The enclosed nohup command uses unquoted path placeholders and starts a server in the background. Malicious path text can alter shell execution, and interrupted workflows can leave the process running.
Medium
Ruby/shell backtick execution
3. Write to a temp file (e.g., `/tmp/eval_review_<skill-name>.html`) and open it: `open /tmp/eval_re
The open command uses an unquoted skill name inside a shared temporary path. Shell metacharacters in the name can change command execution.
Medium
Ruby/shell backtick execution
```bash
The optimization command uses unquoted file, skill, and model placeholders. Values containing shell syntax can change the intended command when substituted by an agent.
Medium
Ruby/shell backtick execution
```bash
The packaging command uses an unquoted skill path placeholder. A crafted path can be parsed as shell syntax instead of a single argument.
Medium
nohup (background persistent process)
nohup python <skill-creator-path>/eval-viewer/generate_review.py \
The workflow intentionally starts the review server with nohup in the background. If the workflow stops before cleanup, the local service remains running.
Medium
Temp directory access
3. Write to a temp file (e.g., `/tmp/eval_review_<skill-name>.html`) and open it: `open /tmp/eval_re
The instruction creates a predictable HTML filename in the shared temporary directory. Existing symlinks or name collisions can redirect or replace the generated review file.
Medium
Temp directory access
- **Copy to a writeable location before editing.** The installed skill path may be read-only. Copy t
The update workflow recommends a fixed skill-named directory under shared temporary storage. It does not require exclusive creation or reject an existing symlink.
Medium
Temp directory access
- **If packaging manually, stage in `/tmp/` first**, then copy to the output directory -- direct wri
Manual packaging is instructed to stage files in shared temporary storage without secure directory creation. A collision or symlink can redirect staged content.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<script src="https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js" integrity="sha384-En
Opening the viewer loads executable SheetJS code from an external CDN. Integrity metadata limits tampering, but the page still makes an outbound third-party request.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
Low
Temp file creation
live_report_path = Path(tempfile.gettempdir()) / f"skill_description_report_{skill_path.name}_{times
The report uses a predictable shared temporary path based on the skill name and current second. A local attacker can pre-create a symlink and redirect the later write.
Risk Factors
📁 Filesystem access (15)
agents/grader.md:83 agents/grader.md:104 scripts/aggregate_benchmark.py:377 scripts/aggregate_benchmark.py:383 scripts/package_skill.py:13 scripts/package_skill.py:39 scripts/package_skill.py:15 scripts/package_skill.py:91 scripts/run_loop.py:13 scripts/run_loop.py:274 SKILL.md:242 SKILL.md:287 SKILL.md:369 SKILL.md:440 SKILL.md:441
⚡ Contains scripts (9)
⚙️ External commands (50)
assets/eval_review.html:82 assets/eval_review.html:89-99 assets/eval_review.html:126 eval-viewer/generate_review.py:291 eval-viewer/viewer.html:709 eval-viewer/viewer.html:1109 scripts/improve_description.py:35 scripts/improve_description.py:5 scripts/improve_description.py:21 scripts/improve_description.py:161 scripts/run_eval.py:85 scripts/run_eval.py:46 SKILL.md:17 SKILL.md:75-84 SKILL.md:84-101 SKILL.md:101-108 SKILL.md:108-120 SKILL.md:120-127 SKILL.md:127-130 SKILL.md:130-135 SKILL.md:135-145 SKILL.md:145-147 SKILL.md:147-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:165-167 SKILL.md:167 SKILL.md:175-182 SKILL.md:182-185 SKILL.md:185-186 SKILL.md:186 SKILL.md:188-190 SKILL.md:190-197 SKILL.md:197-201 SKILL.md:201-205 SKILL.md:205 SKILL.md:209 SKILL.md:211-217 SKILL.md:217-225 SKILL.md:225 SKILL.md:228-230 SKILL.md:230-231 SKILL.md:231 SKILL.md:234-237 SKILL.md:237-244 SKILL.md:244-245 SKILL.md:245-247 SKILL.md:247 SKILL.md:265-269 SKILL.md:269-271
🌐 Network access (16)
assets/eval_review.html:7 assets/eval_review.html:8 assets/eval_review.html:9 eval-viewer/generate_review.py:449 eval-viewer/generate_review.py:443 eval-viewer/generate_review.py:446 eval-viewer/viewer.html:666 eval-viewer/viewer.html:1012 eval-viewer/viewer.html:1044 eval-viewer/viewer.html:7 eval-viewer/viewer.html:8 eval-viewer/viewer.html:9 eval-viewer/viewer.html:10 scripts/generate_report.py:39 scripts/generate_report.py:40 scripts/generate_report.py:41
🔑 Env variables (3)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/davila7-skill-development/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/davila7-skill-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/davila7-skill-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-skill-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/davila7-skill-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
davila7. (2026). skill-creator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-skill-development/audits/9BibTeX citation
@techreport{davila7-davila7-skill-development-2026,
author = {davila7},
title = {skill-creator security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/davila7-skill-development/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-creator security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-skill-development/audits/9"
identifiers:
- type: other
value: "skillstore:davila7-skill-development:audit:9"
description: "Skillstore immutable audit report identifier"
Compare variants
24 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
Joseph OBrien Recommended
89jobrien-skill-creator
Skillstore Score 83
Evidence Confidence High
Skillstore usage 52
Updated
2026-08-21
vercel-labs-skill-creator
Skillstore Score 81
Evidence Confidence High
Skillstore usage 27
Updated
2026-08-21
7spade-skill-creator
Skillstore Score 80
Evidence Confidence High
Skillstore usage 41
Updated
2026-08-21
daviddworetzky-skill-creator
Skillstore Score 79
Evidence Confidence High
Skillstore usage 8
Updated
2026-08-21
bom-98-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 11
Updated
2026-08-21
doyajin174-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 8
Updated
2026-08-21
cesaraugustusgrob-skill-creator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 7
Updated
2026-08-21
skill-creator
Skillstore Score 76
Evidence Confidence High
Skillstore usage 42
Updated
2026-08-21
cam10001110101-skill-creator
Skillstore Score 75
Evidence Confidence High
Skillstore usage 16
Updated
2026-08-21
astrabit-cpt-skill-creator
Skillstore Score 73
Evidence Confidence High
Skillstore usage 13
Updated
2026-08-21
zhanlincui-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 312
Updated
2026-08-21
barissozen-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 14
Updated
2026-08-21
abdullahmalik17-skill-creator
Skillstore Score 72
Evidence Confidence High
Skillstore usage 12
Updated
2026-08-21
langchain-ai-skill-creator
Skillstore Score 67
Evidence Confidence High
Skillstore usage 18
Updated
2026-08-21
daothihuong2111-skill-creator
Skillstore Score 67
Evidence Confidence High
Skillstore usage 11
Updated
2026-08-21
benderfendor-skill-creator
Skillstore Score 66
Evidence Confidence High
Skillstore usage 25
Updated
2026-08-21
92bilal26-skill-creator
Skillstore Score 50
Evidence Confidence High
Skillstore usage 12
Updated
2026-08-21
sickn33-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 45
Updated
2026-08-21
artemisai-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated
2026-08-21
davila7-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
chinchillaenterprises-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
azeem-2-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
davila7 Current
davila7-skill-development
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
composiohq-skill-creator
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 77
Architecture
85
Maintainability
87
Content
72
Community
91
Spec Compliance
What You Can Build
Create a First Skill
Turn a repeatable workflow into structured instructions, supporting resources, and practical test prompts.
Improve an Existing Skill
Compare revised and baseline outputs, review failures, and refine instructions across measured iterations.
Optimize Skill Triggering
Test positive and negative queries, measure trigger rates, and select a stronger description using held-out results.
Try These Prompts
Draft a Basic Skill
Create a skill for [workflow]. Ask about inputs, outputs, tools, edge cases, and triggering phrases before drafting it.
Review an Existing Skill
Review the skill at [path]. Identify unclear instructions, missing safeguards, weak trigger guidance, and opportunities for progressive disclosure.
Run Comparative Evaluations
Evaluate the skill at [path] using [test prompts]. Compare revised and baseline outputs, grade assertions, and summarize benchmark results.
Optimize and Package
Optimize the trigger description for [skill path] using positive and negative queries, validate held-out performance, then package the approved version.
Best Practices
- Confirm the intended workflow, trigger conditions, inputs, outputs, and dependencies before drafting.
- Use realistic prompts and assertions that verify meaningful outcomes instead of file presence alone.
- Review qualitative outputs with the user before applying benchmark-driven revisions.
Avoid
- Do not optimize against a small test set without separate holdout queries.
- Do not treat high pass rates as sufficient when assertions are weak or non-discriminating.
- Do not package third-party skill directories before reviewing scripts, links, symlinks, and generated files.
Frequently Asked Questions
Can this skill create a skill from scratch?
Yes. It gathers requirements, drafts instructions, proposes tests, supports evaluation, and packages the completed skill.
Can it improve an existing skill?
Yes. It can preserve a baseline, compare outputs, analyze feedback, and revise the skill across multiple iterations.
Does it require the Claude CLI?
Only automated description optimization requires Claude CLI. Drafting, review, validation, and packaging can use other supported environments.
Does it support Codex?
The guidance supports Codex, but Claude-specific optimization scripts require Claude CLI and its authentication.
How are skill improvements measured?
The workflow combines assertion pass rates, repeated-run variance, time, token use, transcript analysis, and human feedback.
Can it package the final skill?
Yes. The included validator checks basic structure, and the packager creates a distributable skill archive.