Skill Creator

Create, update, evaluate, and manage skills across agents by defining intent, drafting, testing, benchmarking, iterating, and distributing them within a 2-la...

This package appears to be a legitimate toolkit for authoring and evaluating skills, but it performs powerful local actions. Before installing or running it: - Verify provenance: there is no homepage and the owner is unknown; prefer a trusted repository/source. - Review the scripts (especially scripts/* and eval-viewer/generate_review.py). They read workspace directories, embed files into HTML, start a local HTTP server, and call subprocesses (including lsof) and os.kill to free ports — understand and agree to those behaviors. - Pay particular attention to instructions that write to ~/.skills/ and suggest running a sync script: these will add or modify skill files and can affect which agents see which skills. - The SKILL.md contains a strange inconsistency (it says never create skills named 'skill-creator' yet this package uses that name). Ask the publisher for clarification or prefer a clearly documented upstream repository. - Run the tooling in an isolated environment (temporary VM, container, or throwaway account) and do not point it at directories containing sensitive data until you are confident it behaves as expected. - If you plan to allow autonomous invocation, be cautious: the tool can be used to create other skills and generate content that may be auto-distributed. Consider manual review steps or limiting its permissions. If you want, I can highlight the exact lines in the scripts that call subprocess/os.kill, or summarize what the eval-viewer will serve from a sample workspace so you can judge exposure more precisely.

Type: OpenClaw Skill Name: skill-creator-usm Version: 1.0.0 This skill bundle provides a comprehensive framework for developing and optimizing AI skills but employs several high-risk capabilities. Key indicators include the use of the `subprocess` module to execute shell commands (specifically the `claude` CLI) in `run_eval.py`, the instantiation of a local HTTP server in `generate_review.py` (defaulting to `http://localhost:3117`) to host an evaluation viewer, and external API communication with Anthropic in `improve_description.py`. While these features are aligned with the stated purpose of benchmarking and iteratively improving agent skills, the combination of shell execution, local network hosting, and automated file manipulation in sensitive directories like `~/.skills/` constitutes a significant risk profile.