skill-creator
“Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.”
agents
assets
eval-viewer
references
scripts
agents/analyzer.mdagents/comparator.mdagents/grader.mdaipkg.jsonassets/eval_review.htmleval-viewer/generate_review.pyeval-viewer/viewer.htmlLICENSE.txtREADME.mdreferences/schemas.mdscripts/__init__.pyscripts/aggregate_benchmark.pyscripts/generate_report.pyscripts/improve_description.pyscripts/package_skill.pyscripts/quick_validate.pyscripts/run_eval.pyscripts/run_loop.pyscripts/utils.pySKILL.md- 01AST4subprocess module call85%MEDIUM
scripts/improve_description.py:35
detailhide
The subprocess.run() call executes the 'claude' command with user-controlled prompt data passed via stdin. While the immediate code appears benign, this creates a privilege escalation risk: a malicious skill description injection through eval_results could lead to arbitrary command execution. The skill runs with the user's full environment and Claude Code session credentials.
# programmatic subprocess usage is safe. Same pattern as run_eval.py. env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"} result = subprocess.run( cmd, input=prompt, capture_output=True,fix Validate and sanitize eval_results JSON before use. Implement strict schema validation for eval_results structure. Consider using a local model or API call instead of subprocess execution. If subprocess is necessary, use explicit argument lists rather than relying on shell interpretation, and implement strict input validation for all prompt components.
- 02AST4subprocess module call75%MEDIUM
scripts/run_eval.py:85
detailhide
The subprocess.Popen call executes the 'claude' command with user-controlled input (skill_description and query parameters). While the code attempts to sanitize the environment by removing CLAUDECODE, the command construction itself is vulnerable. The skill_description is embedded into a markdown file without proper escaping, and if an attacker controls the skill_description parameter, they could inject shell metacharacters or markdown syntax to break out of the intended command structure. The skill_name parameter is also user-controlled and used in file operations.
# programmatic subprocess usage is safe. env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"} process = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,fix Use subprocess with shell=False (already done) and args list (already done). However, additionally validate and sanitize all user-controlled inputs (skill_name, skill_description) before using them in file operations or command construction. Consider using shlex.quote() for any dynamic path components. Implement strict allowlisting for skill_name to only permit alphanumeric characters, hyphens, and underscores.
- 03SDI-290%HIGH
scripts/improve_description.py:35
detailhide
This skill's stated purpose is to improve skill descriptions and measure performance. Executing arbitrary subprocess commands (even to call 'claude') is not a necessary function for description optimization and violates the principle of least privilege. An attacker could inject malicious eval_results to execute arbitrary commands on the user's system with the user's credentials and environment variables.
33 env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}3435 result = subprocess.run(36 cmd,37 input=prompt,fix Replace subprocess execution with direct API calls to Claude if available, or implement a sandboxed subprocess environment. Remove the ability to execute external commands entirely. If subprocess execution is truly necessary, document it explicitly and require explicit user confirmation before execution.
- 04SQP-280%MEDIUM
scripts/improve_description.py:35
detailhide
The subprocess execution happens silently without any user disclosure or confirmation dialog. Users invoking this skill to improve descriptions have no indication that arbitrary system commands will be executed. This violates transparency principles and prevents users from making informed decisions about running potentially dangerous operations.
33 env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}3435 result = subprocess.run(36 cmd,37 input=prompt,fix Add explicit user warnings and confirmation prompts before executing subprocess commands. Document all subprocess operations in skill description and logs. Implement an audit trail showing exactly what commands were executed and with what environment. Consider implementing a dry-run mode where users can review the commands before execution.
- 05SQP-270%MEDIUM
scripts/run_eval.py:68
detailhide
The function creates temporary command files in .claude/commands/ without user confirmation or warning. While the files are cleaned up in a finally block, the creation of arbitrary files in the user's .claude directory without explicit user awareness could be exploited if an attacker controls the skill_name parameter. An attacker could create files with malicious names or in unexpected locations. Additionally, file cleanup in a finally block may fail silently, leaving behind temporary files.
66 f"This skill handles: {skill_description}\n"67 )68 command_file.write_text(command_content)6970 cmd = [fix Add explicit user confirmation before creating files in the .claude directory, or use a dedicated temporary directory with proper cleanup verification. Implement strict validation of skill_name to ensure it cannot contain path traversal sequences (../, etc.). Verify file deletion and log warnings if cleanup fails. Consider using Python's tempfile module for more robust temporary file handling.