The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it defines workflows for evaluating external, untrusted data using LLM-as-judge prompts.
Ingestion points: The skill ingests untrusted data from trace spans and experiment runs using commands such as ax spans export and ax experiments export (see SKILL.md, Workflow A Step 6 and Workflow B Step 5).
Boundary markers: The provided template examples use simple {variable} interpolation (e.g., {input}, {output}, {context}) without delimiters or instructions to the model to ignore potential instructions embedded within that data (see SKILL.md, Best Practices for Template Design).
Capability inventory: The skill uses the ax tasks trigger-run command to send these interpolated prompts to various LLM provider integrations for execution and scoring.
Sanitization: There are no instructions or built-in mechanisms described for sanitizing or validating the content of the spans before they are processed by the judge model.

arize-evaluator