skill-creator

anthropics/skills/skills/skill-creator

This skill helps users create, test, benchmark, and optimize AI agent skills using subagents, local Python scripts, and a browser-based evaluation viewer. The main risks are cross-site scripting (XSS) and cross-site request forgery (CSRF) in the local evaluation review server, which could allow untrusted test outputs or web pages to inject content into the skill feedback loop.

What it can reach

Files

Reads and writes skill directories, evaluation workspaces, temporary HTML reports in /tmp, temporary command files in .claude/commands/, and .skill zip archives.

Shell commands

Executes subprocesses including 'claude -p' to test skill triggering and improve descriptions, as well as 'lsof' and 'os.kill' to free local TCP ports.

Network

Starts a local HTTP server on 127.0.0.1:3117 to serve the evaluation viewer and loads fonts and SheetJS from external CDNs in the browser.

Browser

Opens local HTML reports and the local evaluation review server URL in the user's default web browser.

Findings

1. MediumUnescaped script-closing tags in embedded JSON allow Stored XSS in the evaluation viewer

   skills/skill-creator/eval-viewer/generate_review.py:70

   generate_review.py serializes prompts, grading results, and the full contents of generated output files using json.dumps() and inserts the raw string directly into a <script> tag in viewer.html. Because json.dumps() does not escape forward slashes, any prompt or output file containing '</script>' will prematurely close the script block and execute subsequent text as arbitrary HTML and JavaScript in the user's browser.

   Fix: Escape '</' sequences in the serialized JSON before injecting it into the HTML template (for example, data_json = json.dumps(embedded).replace('</', '<\\/')).

2. LowMissing CSRF protection on local feedback endpoint allows overwriting feedback.json

   skills/skill-creator/eval-viewer/generate_review.py:369

   The local HTTP server on 127.0.0.1:3117 accepts POST requests to /api/feedback without checking the Origin header, Content-Type header, or a CSRF token. While the review server is running, any website open in the user's browser can send a cross-origin POST request to overwrite feedback.json, which the agent subsequently reads as user instructions for modifying the skill.

   Fix: Validate that the Origin header matches http://localhost:<port> or http://127.0.0.1:<port> and require a custom header or random per-session token on POST requests.

3. LowPort cleanup command can terminate client processes such as the user's browser

   skills/skill-creator/eval-viewer/generate_review.py:292

   Before binding the HTTP server, _kill_port() runs 'lsof -ti :<port>' and sends SIGTERM to every returned process ID. Without the '-sTCP:LISTEN' filter, lsof returns not only the listening server process but also any client process with an active connection to that port, such as the user's web browser.

   Fix: Pass '-sTCP:LISTEN' to lsof (e.g., ['lsof', '-ti', f'TCP:{port}', '-sTCP:LISTEN']) so only listening server processes are targeted.