The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs several standard development and security tools including Semgrep, Playwright, and various linting utilities. These downloads target official package registries (NPM, PyPI) or trusted GitHub repositories such as microsoft/playwright-cli and semgrep/semgrep-rules.
[COMMAND_EXECUTION]: The skill uses shell commands to manage the evaluation environment, including git worktree for isolated project checkouts and pkill -9 node for cleaning up backend processes. These operations are restricted to the local testing environment and are standard practice for automated test runners.
[DYNAMIC_EXECUTION]: The skill generates specialized test harnesses (api_test.mjs, ui_test.mjs) based on the requirements and codebase of the project being evaluated. These generated scripts are then executed using Node.js to perform the assessment. This is a core functional requirement of the evaluation workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it parses data from untrusted projects (like README.md and route definitions) to generate test logic. However, this is a known risk for code analysis tools, and the skill implements isolation measures like temporary worktrees to mitigate impacts.

code-arena-en