Skill Creator Skill 安全审计

386387def main() -> None:388    parser = argparse.ArgumentParser(description="Generate and serve eval review")389    parser.add_argument("workspace", type=Path, help="Path to workspace directory")390    parser.add_argument("--port", "-p", type=int, default=3117, help="Server port (default: 3117)")391    parser.add_argument("--skill-name", "-n", type=str, default=None, help="Skill name for header")392    parser.add_argument(

437438    # Kill any existing process on the target port439    port = args.port440    _kill_port(port)441    handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path)

269270    embedded = {271        "skill_name": skill_name,272        "runs": runs,273        "previous_feedback": previous_feedback,274        "previous_outputs": previous_outputs,275    }276    if benchmark:277        embedded["benchmark"] = benchmark278279    data_json = json.dumps(embedded)280281    return template.replace("/*__EMBEDDED_DATA__*/", f"const EMBEDDED_DATA = {data_json};")282

646647  <script>648    // ---- Embedded data (injected by generate_review.py) ----649    /*__EMBEDDED_DATA__*/650651    // ---- State ----

8889    # Create the .skill file (zip format)90    try:91        with zipfile.ZipFile(skill_filename, 'w', zipfile.ZIP_DEFLATED) as zipf:92            # Walk through the skill directory, excluding build artifacts93            for file_path in skill_path.rglob('*'):94                if not file_path.is_file():95                    continue96                arcname = file_path.relative_to(skill_path.parent)97                if should_exclude(arcname):98                    print(f"  Skipped: {arcname}")99                    continue100                zipf.write(file_path, arcname)101                print(f"  Added: {arcname}")102

50    """51    unique_id = uuid.uuid4().hex[:8]52    clean_name = f"{skill_name}-skill-{unique_id}"53    project_commands_dir = Path(project_root) / ".claude" / "commands"54    command_file = project_commands_dir / f"{clean_name}.md"5556    try:57        project_commands_dir.mkdir(parents=True, exist_ok=True)58        # Use YAML block scalar to avoid breaking on quotes in description59        indented_desc = "\n  ".join(skill_description.split("\n"))60        command_content = (61            f"---\n"62            f"description: |\n"63            f"  {indented_desc}\n"64            f"---\n\n"65            f"# {skill_name}\n\n"66            f"This skill handles: {skill_description}\n"67        )68        command_file.write_text(command_content)69

178        return triggered179    finally:180        if command_file.exists():181            command_file.unlink()182

440    _kill_port(port)441    handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path)442    try:443        server = HTTPServer(("127.0.0.1", port), handler)444    except OSError:

437438    # Kill any existing process on the target port439    port = args.port440    _kill_port(port)441    handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path)442    try:443        server = HTTPServer(("127.0.0.1", port), handler)444    except OSError:445        # Port still in use after kill attempt — find a free one446        server = HTTPServer(("127.0.0.1", 0), handler)447        port = server.server_address[1]448

7980        # Remove CLAUDECODE env var to allow nesting claude -p inside a81        # Claude Code session. The guard is for interactive terminal conflicts;82        # programmatic subprocess usage is safe.83        env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}8485        process = subprocess.Popen(86            cmd,87            stdout=subprocess.PIPE,88            stderr=subprocess.DEVNULL,89            cwd=project_root,90            env=env,91        )

248    parser.add_argument("--description", default=None, help="Override starting description")249    parser.add_argument("--num-workers", type=int, default=10, help="Number of parallel workers")250    parser.add_argument("--timeout", type=int, default=30, help="Timeout per query in seconds")251    parser.add_argument("--max-iterations", type=int, default=5, help="Max improvement iterations")252    parser.add_argument("--runs-per-query", type=int, default=3, help="Number of runs per query")253    parser.add_argument("--trigger-threshold", type=float, default=0.5, help="Trigger rate threshold")254    parser.add_argument("--holdout", type=float, default=0.4, help="Fraction of eval set to hold out for testing (0 to disable)")255    parser.add_argument("--model", required=True, help="Model for improvement")256    parser.add_argument("--verbose", action="store_true", help="Print progress to stderr")

338339Create 20 eval queries — a mix of should-trigger and should-not-trigger. Save as JSON:340341```json342[343  {"query": "the user prompt", "should_trigger": true},344  {"query": "another prompt", "should_trigger": false}345]346```

25    """26    cmd = ["claude", "-p", "--output-format", "text"]27    if model:28        cmd.extend(["--model", model])2930    # Remove CLAUDECODE env var to allow nesting claude -p inside a31    # Claude Code session. The guard is for interactive terminal conflicts;32    # programmatic subprocess usage is safe. Same pattern as run_eval.py.33    env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}3435    result = subprocess.run(36        cmd,37        input=prompt,38        capture_output=True,39        text=True,40        env=env,41        timeout=timeout,