skill-creator

An agent skill by anthropics, from anthropics/skills. Tags: anthropic, debugging, developer-tools.

What it does

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add anthropics/skills --skill skill-creator

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/anthropics/skills
cp -r skills/skills/skill-creator ~/.claude/skills/skill-creator

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a workflow tool for authoring, testing, benchmarking, and packaging other skills. Its main risks are the repeated `claude -p` subprocess calls, temporary writes into the project’s `.claude/` area, and the fact that it auto-generates review/report artifacts while moving prompts and skill content to a remote model service.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It repeatedly spawns external processes, including `claude -p` and `lsof`/browser-related helpers; for example `scripts/run_eval.py` uses `process = subprocess.Popen(cmd, ...)` and `scripts/improve_description.py` uses `result = subprocess.run(...)`.
Network access	2 (moderate)	The core loop sends prompts, skill content, and revised descriptions to the Claude service through `claude -p`, so data leaves the machine over the network even though the review server itself is local.
Filesystem reach	2 (moderate)	It writes outside the skill directory into the project root, notably temporary `.claude/commands/*.md` files in `scripts/run_eval.py`, plus benchmark/report artifacts such as `benchmark.json` and HTML reports.
Secrets & credentials	1 (low)	It uses the current Claude Code login/auth indirectly via `claude -p`, but there is no code that reads keychains, `.env` files, browser sessions, or passwords.
Privilege & persistence	0 (none)	I found no sudo usage, global installs, service registration, shell startup edits, or other privilege-altering steps.
Instruction hijack surface	0 (none)	The skill gives process instructions, but it does not tell the agent to ignore safeguards, hide anything, or follow untrusted remote instructions; the system-prompt mention is only for selecting the same model for evaluation parity.
Irreversible actions	1 (low)	It automates eval runs, opens a review page, and can rewrite a skill description or package a `.skill` file, but those actions stay local and are intended to be user-reviewed.
Transparency	2 (moderate)	One shipped file could not be inspected here: `eval-viewer/viewer.html` was listed as unreadable, so part of the review UI remains unverified.

Before installing

Read `scripts/run_eval.py` and `scripts/run_loop.py` first; they invoke `claude -p` and create `.claude/commands/*.md` files.
Confirm you’re okay with eval prompts and skill content being sent to the Claude service from your current login.
Inspect `eval-viewer/viewer.html` separately if the review UI matters to you, since it wasn’t readable in this pass.
Try it in a scratch repo before using it on an important project, because it will write benchmark/report artifacts and may leave temp `.claude/` files if interrupted.

Rated 2026-09-22 by an automated review of 17 files from the skill's repository.

Source

Repository: anthropics/skills (all skills from this repository)
Path: skills/skill-creator/SKILL.md
Branch: main
Updated: 2026-09-19

claude-api — Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration.
mcp-builder — Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools.
webapp-testing — Toolkit for interacting with and testing local web applications using Playwright.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.