The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/run_evals.py and scripts/run_triggers.py use subprocess.run to execute platform-specific commands based on a template provided in the adapter configuration (e.g., assets/adapter-claude-code.json). These commands incorporate user-provided inputs via string replacement.
[PRIVILEGE_ESCALATION]: The default configuration in assets/adapter-claude-code.json includes the --dangerously-skip-permissions flag for the claude CLI. This flag is used to bypass interactive security and permission prompts during headless execution, effectively overriding platform-level access controls.
[DYNAMIC_EXECUTION]: The skill features a self-improvement loop documented in references/self-improvement.md that autonomously generates and applies modifications to skill files, then re-executes the modified code to verify improvements. This involves dynamic generation and execution of local script content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of skills and eval cases under test. It is vulnerable to indirect injection because its core functionality involves ingesting these inputs and performing powerful actions like command execution and file modification based on the results.
[INDIRECT_PROMPT_INJECTION] Ingestion points: The scripts scripts/run_evals.py and scripts/run_triggers.py load skill instruction files and JSON-formatted evaluation cases.
[INDIRECT_PROMPT_INJECTION] Boundary markers: The skill uses basic string interpolation for prompts with minimal boundary separation such as the bracketed state_prefix format.
[INDIRECT_PROMPT_INJECTION] Capability inventory: The skill has access to subprocess.run for system command execution and Path.write_text for modifying local files during the improvement loop.
[INDIRECT_PROMPT_INJECTION] Sanitization: There is no evidence of escaping or strict validation for external content before it is interpolated into command templates or used in decision-making loops.

bmad-eval-runner