The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external, untrusted data including codebases, documents, and error logs, which introduces a risk of indirect prompt injection.
Ingestion points: The instructions in SKILL.md (Step 2) explicitly direct the agent to read and understand source code and documents provided in the user request.
Boundary markers: While a structured output format is defined, the skill does not provide clear delimiters or instructions for the agent to distinguish between the content of the source data and potential instructions embedded within it.
Capability inventory: The skill environment provides the agent with the Bash, Read, Glob, and Grep tools, enabling file system interaction that could be misused if an indirect injection attack is successful.
Sanitization: There are no explicit steps for sanitizing or filtering the content read from external files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill package contains a Node.js script, scripts/validate-evals.mjs, used to verify the schema of the evaluation configuration. This script is intended for local validation and performs safe file system operations (reading and parsing JSON). It does not include dangerous patterns such as dynamic code evaluation, network calls, or privilege escalation attempts.

eli5