The Agent Skills Directory

[SAFE]: The skill is implemented using standard Python scripts that operate strictly on local files. No evidence of obfuscation, remote code execution, or unauthorized data access was found. All scripts use the Python standard library and avoid external dependencies.
[COMMAND_EXECUTION]: The scripts/campaign_manager.py script constructs command-line strings for simulation jobs using a user-provided template. However, the skill does not execute these commands itself; it only stores them for external execution by the user or agent, and no unsafe shell execution patterns (like eval or os.system on untrusted input) were detected within the scripts.
[PROMPT_INJECTION]: The skill processes external simulation results in scripts/result_aggregator.py, which constitutes an indirect prompt injection surface. This is mitigated by explicit type validation of the processed data.
Ingestion points: Simulation result files (JSON) are read by scripts/result_aggregator.py.
Boundary markers: Absent from the documentation, but data is processed programmatically rather than interpolated directly into free-text prompts.
Capability inventory: The skill uses Read, Write, and Bash tools to manage configurations and output results.
Sanitization: The extract_metric and aggregate_results functions perform strict numeric type checking (isinstance(value, (int, float))), ensuring that only valid numerical data is used in calculations and preventing the propagation of malicious text payloads.

simulation-orchestrator