Skill Creator Pro

This skill is mostly coherent with its purpose, but exercise caution before running it against a workspace that may contain secrets or sensitive files. Specific points to consider: - The included scripts (e.g., eval-viewer/generate_review.py) recursively read files from a workspace and embed text/binary files (PDF, XLSX, images) into a standalone HTML, so any secrets in that workspace could end up embedded in the generated HTML. - The scripts use subprocess.run (e.g., to call lsof to kill a port) and may attempt to invoke an external CLI ('claude -p') if present — review those calls and avoid running them if you don't trust the environment or the external tools. - The generated viewer.html loads Google Fonts (network call) and the Python script may spawn a tiny HTTP server and open a browser; if you plan to share the generated HTML, confirm it contains only intended content. Mitigations before installing/using: - Inspect the repository locally (you already have the files) and read generate_review.py and run_loop.py to understand exactly which paths they read and which subprocesses they call. - Run the scripts only on a dedicated, scrubbed workspace that contains only the eval artifacts you intend to expose. Remove any credentials, private keys, or unrelated files first. - If you need extra safety, run the scripts in an isolated environment (container, VM) with no network and limited filesystem mounts. - If you won't use the optional external CLI (claude -p), disable or remove those code paths to avoid accidental invocation. - Prefer manual review of the generated HTML before sending it to others; verify that the content included is expected. Given these behaviors, the skill is not clearly malicious but has broader file- and process-access than casual users might expect — classify as suspicious until you confirm you're running it in a safe, intended workspace.