Skill Creator Pro

Create new skills, modify and improve existing skills, and measure skill performance with eval-driven iteration. Use when users want to create a skill from s...

This skill is mostly coherent with its purpose, but exercise caution before running it against a workspace that may contain secrets or sensitive files. Specific points to consider: - The included scripts (e.g., eval-viewer/generate_review.py) recursively read files from a workspace and embed text/binary files (PDF, XLSX, images) into a standalone HTML, so any secrets in that workspace could end up embedded in the generated HTML. - The scripts use subprocess.run (e.g., to call lsof to kill a port) and may attempt to invoke an external CLI ('claude -p') if present — review those calls and avoid running them if you don't trust the environment or the external tools. - The generated viewer.html loads Google Fonts (network call) and the Python script may spawn a tiny HTTP server and open a browser; if you plan to share the generated HTML, confirm it contains only intended content. Mitigations before installing/using: - Inspect the repository locally (you already have the files) and read generate_review.py and run_loop.py to understand exactly which paths they read and which subprocesses they call. - Run the scripts only on a dedicated, scrubbed workspace that contains only the eval artifacts you intend to expose. Remove any credentials, private keys, or unrelated files first. - If you need extra safety, run the scripts in an isolated environment (container, VM) with no network and limited filesystem mounts. - If you won't use the optional external CLI (claude -p), disable or remove those code paths to avoid accidental invocation. - Prefer manual review of the generated HTML before sending it to others; verify that the content included is expected. Given these behaviors, the skill is not clearly malicious but has broader file- and process-access than casual users might expect — classify as suspicious until you confirm you're running it in a safe, intended workspace.

Type: OpenClaw Skill Name: skill-creator-pro Version: 2.0.0 The bundle is a comprehensive development toolset designed to create, test, and optimize OpenClaw skills, adapted from official Anthropic patterns. It contains Python scripts for orchestrating evaluation loops (run_loop.py), measuring triggering accuracy (run_eval.py), and a local HTTP server (generate_review.py) to host a standalone HTML results viewer (viewer.html). The code uses standard subprocess calls to interact with the Claude CLI and manages local workspace files for benchmarking. No evidence of data exfiltration, malicious persistence, or harmful prompt injection was found; the instructions explicitly include a 'Principle of Lack of Surprise' section forbidding the creation of malware or security exploits.