Skill Creator

This package appears to be a legitimate toolkit for authoring and evaluating skills, but it performs powerful local actions. Before installing or running it: - Verify provenance: there is no homepage and the owner is unknown; prefer a trusted repository/source. - Review the scripts (especially scripts/* and eval-viewer/generate_review.py). They read workspace directories, embed files into HTML, start a local HTTP server, and call subprocesses (including lsof) and os.kill to free ports — understand and agree to those behaviors. - Pay particular attention to instructions that write to ~/.skills/ and suggest running a sync script: these will add or modify skill files and can affect which agents see which skills. - The SKILL.md contains a strange inconsistency (it says never create skills named 'skill-creator' yet this package uses that name). Ask the publisher for clarification or prefer a clearly documented upstream repository. - Run the tooling in an isolated environment (temporary VM, container, or throwaway account) and do not point it at directories containing sensitive data until you are confident it behaves as expected. - If you plan to allow autonomous invocation, be cautious: the tool can be used to create other skills and generate content that may be auto-distributed. Consider manual review steps or limiting its permissions. If you want, I can highlight the exact lines in the scripts that call subprocess/os.kill, or summarize what the eval-viewer will serve from a sample workspace so you can judge exposure more precisely.