The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The included scripts (eval-eval.mjs and loop-report.mjs) process local text files or standard input. There are no hardcoded credentials, network operations to external domains, or access to sensitive system paths (e.g., .ssh, .aws).
[REMOTE_CODE_EXECUTION]: No patterns for remote code execution were found. The skill does not use curl | bash, eval(), or dynamic script downloads. Dependency management relies on standard Node.js built-in modules (fs, path, url).
[PROMPT_INJECTION]: The instructions and reference documents focus on objective evaluation criteria and measurement discipline. There are no attempts to bypass safety filters, override system instructions, or extract internal prompts.
[OBFUSCATION]: The skill's content is entirely in plain text. No Base64, hex encoding, zero-width characters, or other obfuscation techniques were identified.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface by processing external files for evaluation purposes.
Ingestion points: Files provided to scripts/eval-eval.mjs and scripts/loop-report.mjs via the --input argument or standard input.
Boundary markers: The skill requires structured Markdown headers (e.g., ## Goal, ## KPI) which serve as delimiters for processed data.
Capability inventory: Local file system read access via node:fs and regex processing. No network or shell execution capabilities are present in the scripts.
Sanitization: The scripts use regex matching to validate content but do not execute instructions found within the input text.

octocode-graph-eval