技能 skill-creator
📦
skill-creator
内容修订 r2 高风险 📁 文件系统访问⚡ 包含脚本⚙️ 外部命令🌐 网络访问🔑 环境变量
创建 AI 技能并进行基准测试
构建可靠的 AI 技能需要清晰的说明、贴近实际的评估和基于度量的迭代。此技能可指导技能的创建、测试、比较、描述优化和打包。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "skill-creator" from https://skillstore.io/skills/davila7-skill-creator.md and its manifest at https://skillstore.io/api/skills/davila7-skill-creator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“skill-creator”。 创建一个用于规范每周事件总结的技能。
预期结果:
- 一份结构化技能草稿，包含触发指导和可重复执行的报告工作流。
- 三个贴近实际的评估提示词，分别涵盖正常、不完整和相互冲突的事件数据。
- 一份简短的验证清单，用于检查必需章节和事实依据。
正在使用“skill-creator”。 改进此数据清理技能，并说明修订后的版本是否表现更好。
预期结果:
- 一份有针对性的修订，保留技能名称和既有资源。
- 基线版本和修订版本的评估结果，包括通过率、耗时和方差。
- 说明哪些更改改善了结果的人工审查记录。
正在使用“skill-creator”。 优化描述，使此技能能够针对相关请求触发。
预期结果:
一份简洁的修订版描述、训练集和留出集得分，以及对剩余误触发情况的总结。
安全审计
高风险v10 • 2026/7/23 打开版本化报告
Most static alerts are false positives caused by Markdown fences, CSS, fixed local paths, and ordinary variable names. Confirmed risks include unsafe HTML generation, symlink-following file reads, inherited agent execution, and automatic termination of processes bound to the selected viewer port. Publication should wait until these high-impact paths are hardened.
18
已扫描文件
5,672
分析行数
22
复核项
0
已忽略误报
已确认安全问题 (6)
高
Generated Viewer Script Injection
Untrusted prompts and output text are serialized into an inline script without escaping HTML closing tags. Crafted content can execute when the review page opens.
json.dumps preserves less-than characters, and the result is inserted directly inside a script element. A closing script tag in embedded data breaks out reliably.
高
Unsafe Eval Template Substitution
The workflow directs raw placeholder replacement for skill metadata and evaluation JSON. Crafted values can break out of HTML or the inline script.
The placeholders sit in HTML text and JavaScript contexts, while the instructions specify direct replacement without context-specific escaping.
高
Symlink-Following Output Embedding
The review generator follows output symlinks and embeds the target bytes. A generated output can expose local files outside the workspace.
Path.is_file and the subsequent read methods follow symbolic links. No resolved-path containment or symlink rejection is present.
高
Symlink-Following Skill Packaging
The packager follows file symlinks during recursive collection. A crafted skill can include readable local files from outside its directory in the archive.
Path.is_file follows symlinks and zipfile.write reads the target content. The loop does not reject symlinks or enforce resolved-path containment.
高
Untrusted Eval Prompts Run With Agent Access
Raw evaluation queries are executed by Claude in the project root with inherited environment variables. Hostile eval data can induce unintended tool actions.
The query is passed directly to claude -p, and the process runs before trigger detection can stop it. No restricted tool policy or environment allowlist is supplied.
高
Prompt Injection Exposure in Description Optimization
Skill content and evaluation queries are embedded as instructions to a tool-capable Claude subprocess. A malicious skill can redirect the optimization session.
Both evaluated content and queries enter the model prompt without an isolation policy. The resulting prompt is sent to the Claude CLI with inherited access.
能力复核项 (22)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Python subprocess.run
result = subprocess.run(
This subprocess finds every process listening on the selected port, then the surrounding code sends each PID SIGTERM. Starting the viewer can terminate an unrelated local service.
高
innerHTML assignment (XSS risk)
content.innerHTML = html;
Fields such as summary.passed, summary.failed, and summary.total are inserted into HTML without type validation or escaping. A crafted grading.json can inject active markup when this innerHTML sink renders.
高
innerHTML assignment (XSS risk)
container.innerHTML = html;
Benchmark HTML is assigned to innerHTML after evidence is interpolated into a quoted title attribute. The escape helper does not encode quotation marks for attribute context.
高
Python subprocess.run
result = subprocess.run(
The fixed command avoids shell injection, but it launches Claude with untrusted skill content and evaluation text. The child inherits project access and nearly the complete environment.
高
Python archive libraries
with zipfile.ZipFile(skill_filename, 'w', zipfile.ZIP_DEFLATED) as zipf:
The archive walk accepts files for which is_file follows symlinks, and zipf.write reads the resolved target. A crafted skill can package local files outside its directory.
高
Python subprocess.Popen
process = subprocess.Popen(
Each raw evaluation query is passed to a Claude process running in the project root. A hostile eval can induce tool actions before the trigger detector terminates the process.
中
innerHTML assignment (XSS risk)
wrapper.innerHTML = htmlStr;
HTML generated from a potentially untrusted workbook is assigned directly to innerHTML. Safety depends on the external SheetJS renderer removing active content and unsafe links.
中
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
The script copies every environment variable except CLAUDECODE into the Claude child process. Unrelated credentials and configuration are therefore exposed to that process.
中
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
The evaluator forwards every environment variable except CLAUDECODE to each Claude child. This exposes unrelated secrets to prompt-driven subprocesses.
中
Temp file creation
live_report_path = Path(tempfile.gettempdir()) / f"skill_description_report_{skill_path.name}_{times
The report uses a predictable timestamped path in the shared temporary directory and later writes through it. A local symlink race could redirect that write.
中
nohup (background persistent process)
nohup python <skill-creator-path>/eval-viewer/generate_review.py \
The workflow explicitly starts the review server with nohup in the background. Cleanup is documented later, but interrupted sessions can leave the process running.
中
Temp directory access
3. Write to a temp file (e.g., `/tmp/eval_review_<skill-name>.html`) and open it: `open /tmp/eval_re
The instructions recommend writing a predictable skill-derived filename under the shared temporary directory. An implementation that follows this literally can overwrite a precreated symlink target.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the local review page preconnects to Google Fonts. This creates an undeclared external request and exposes viewer network metadata.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the local review page preconnects to the Google Fonts asset host. This is a real external network dependency.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
The review page downloads its fonts from Google. The request is expected UI behavior but creates a privacy and availability dependency.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the viewer preconnects to Google Fonts. This creates an external request from an otherwise local review workflow.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the viewer preconnects to the Google Fonts asset host. This is a real external network dependency.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
The viewer downloads its fonts from Google. This leaks routine request metadata and makes rendering depend on a third party.
低
Hardcoded URL
<script src="https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js" integrity="sha384-En
The viewer loads executable SheetJS code from an external CDN. Subresource integrity limits tampering, but the browser still depends on a third-party script host.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Generated reports preconnect to Google Fonts when opened. This creates an external request from a local report.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Generated reports preconnect to the Google Fonts asset host. This is a real external network dependency.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Generated reports download fonts from Google. The request exposes routine network metadata and can fail in offline environments.
风险因素
📁 文件系统访问 (15)
agents/grader.md:83 agents/grader.md:104 scripts/aggregate_benchmark.py:377 scripts/aggregate_benchmark.py:383 scripts/package_skill.py:13 scripts/package_skill.py:39 scripts/package_skill.py:15 scripts/package_skill.py:91 scripts/run_loop.py:13 scripts/run_loop.py:274 SKILL.md:242 SKILL.md:287 SKILL.md:369 SKILL.md:440 SKILL.md:441
⚡ 包含脚本 (9)
⚙️ 外部命令 (50)
assets/eval_review.html:82 assets/eval_review.html:89-99 assets/eval_review.html:126 eval-viewer/generate_review.py:291 eval-viewer/viewer.html:709 eval-viewer/viewer.html:1109 scripts/improve_description.py:35 scripts/improve_description.py:5 scripts/improve_description.py:21 scripts/improve_description.py:161 scripts/run_eval.py:85 scripts/run_eval.py:46 SKILL.md:17 SKILL.md:75-84 SKILL.md:84-101 SKILL.md:101-108 SKILL.md:108-120 SKILL.md:120-127 SKILL.md:127-130 SKILL.md:130-135 SKILL.md:135-145 SKILL.md:145-147 SKILL.md:147-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:165-167 SKILL.md:167 SKILL.md:175-182 SKILL.md:182-185 SKILL.md:185-186 SKILL.md:186 SKILL.md:188-190 SKILL.md:190-197 SKILL.md:197-201 SKILL.md:201-205 SKILL.md:205 SKILL.md:209 SKILL.md:211-217 SKILL.md:217-225 SKILL.md:225 SKILL.md:228-230 SKILL.md:230-231 SKILL.md:231 SKILL.md:234-237 SKILL.md:237-244 SKILL.md:244-245 SKILL.md:245-247 SKILL.md:247 SKILL.md:265-269 SKILL.md:269-271
🌐 网络访问 (16)
assets/eval_review.html:7 assets/eval_review.html:8 assets/eval_review.html:9 eval-viewer/generate_review.py:449 eval-viewer/generate_review.py:443 eval-viewer/generate_review.py:446 eval-viewer/viewer.html:666 eval-viewer/viewer.html:1012 eval-viewer/viewer.html:1044 eval-viewer/viewer.html:7 eval-viewer/viewer.html:8 eval-viewer/viewer.html:9 eval-viewer/viewer.html:10 scripts/generate_report.py:39 scripts/generate_report.py:40 scripts/generate_report.py:41
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/davila7-skill-creator/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/davila7-skill-creator?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/davila7-skill-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-skill-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/davila7-skill-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
davila7. (2026). skill-creator security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-skill-creator/audits/10BibTeX 引用
@techreport{davila7-davila7-skill-creator-2026,
author = {davila7},
title = {skill-creator security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/davila7-skill-creator/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-creator security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-skill-creator/audits/10"
identifiers:
- type: other
value: "skillstore:davila7-skill-creator:audit:10"
description: "Skillstore immutable audit report identifier"
比较变体
24 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 评分最高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
daviddworetzky-skill-creator
Skillstore 评分 79
证据置信度 高
Skillstore 使用量 11
已更新
2026-09-09
cesaraugustusgrob-skill-creator
Skillstore 评分 78
证据置信度 高
Skillstore 使用量 11
已更新
2026-09-09
cam10001110101-skill-creator
Skillstore 评分 75
证据置信度 高
Skillstore 使用量 17
已更新
2026-09-09
abdullahmalik17-skill-creator
Skillstore 评分 72
证据置信度 高
Skillstore 使用量 14
已更新
2026-09-09
daothihuong2111-skill-creator
Skillstore 评分 67
证据置信度 高
Skillstore 使用量 13
已更新
2026-09-09
chinchillaenterprises-skill-creator
Skillstore 评分 38
证据置信度 中
Skillstore 使用量 10
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 中 77
架构
85
可维护性
87
内容
71
社区
91
规范符合性
你能构建什么
起草新技能
将可重复执行的工作流转化为结构化技能，并提供清晰的触发条件、说明、资源和验证步骤。
改进团队自动化
将现有技能与基线进行比较、审查失败情况，并根据度量结果改进说明。
评估市场内容质量
构建可重复执行的评估、检查输出质量，并在分发技能之前记录其性能。
试试这些提示
起草基础技能
为 [task] 创建一个技能。起草前，请询问用户群体、触发短语、必需输入、输出、工具和成功标准。
改进现有技能
审查位于 [path] 的技能。保留其名称，找出不清晰的说明，提出有针对性的修改，并询问我是否需要评估测试。
构建评估集
为 [skill] 创建贴近实际的正向提示词和容易混淆的负向提示词。定义可衡量的成功检查项，并展示评估集以供审查。
基准测试和优化
使用 [test set]，对 [skill path] 及其基线进行基准测试。分析方差、收集人工反馈、改进技能，并打包最佳版本。
最佳实践
- 在编写说明之前，先明确用户意图、触发条件、预期输出和依赖项。
- 使用贴近实际的正向提示词和容易混淆的负向提示词，然后同时审查度量结果和实际输出。
- 保留原始技能名称，并将每次修订与稳定的基线进行比较。
避免
- 不要只针对少量狭窄的提示词进行优化，而不使用留出测试集。
- 不要接受仅检查文件名或表面文本是否存在的通过断言。
- 在审查所捆绑的脚本、依赖项和生成的产物之前，不要打包或发布技能。
常见问题
此技能能否根据一个想法创建新技能？
可以。它会收集需求、起草技能、创建测试提示词，并支持审查和迭代。
它能否改进现有技能？
可以。它会保留技能名称、评估当前行为、应用有针对性的更改，并比较不同修订版本。
它是否会测试技能能否正确触发？
可以。它支持正向和负向触发提示词、重复运行、阈值和留出测试。
描述优化是否需要外部软件？
是的。自动优化工具需要 Claude CLI 和已通过身份验证的 Claude Code 会话。
它能否打包完成后的技能？
可以。它会验证基本技能结构，并创建可分发的 .skill 归档文件。
基准测试成功是否能保证安全性？
不能。基准测试衡量的是选定的行为。对于脚本、依赖项和数据处理，需要单独进行安全审查。