The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains the phrase 'Ignore previous instructions' within the 'Data Design Quadrants' table in SKILL.md. This is clearly presented as a descriptive example of an adversarial input that a user might want to include in their own evaluation dataset, rather than a directive to the agent to bypass its own safety protocols. This is identified as a false positive.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external data which introduces a potential attack surface.
Ingestion points: The skill reads user-provided agent traces, production logs, and product specifications to extract evaluation dimensions.
Boundary markers: The instructions do not prescribe specific delimiters or clear boundary markers (such as XML tags) to separate untrusted trace data from the agent's internal instructions.
Capability inventory: The agent is capable of writing the processed data to local files (eval-data/dataset.jsonl) and executing a local Python script (scripts/coverage_check.py) via the shell.
Sanitization: No explicit sanitization or filtering of the content extracted from logs or specs is mentioned.
Risk assessment: This surface is inherent to the specialized task of evaluation design and is mitigated by the fact that the bundled analysis script is safe.
[COMMAND_EXECUTION]: The skill utilizes a bundled script (scripts/coverage_check.py) to validate dataset coverage. Technical analysis of the script confirms it uses only Python standard libraries, performs benign statistical aggregations, and contains no network-reaching or sensitive file-access logic.

eval-design