The Agent Skills Directory

[SAFE]: The skill implements a robust security architecture for benchmarking AI agents. It enforces non-negotiable invariants for isolation, such as using fresh subagent contexts for every case and attempt to prevent information leakage between the worker agent and the evaluation framework.- [SAFE]: The bundled Node.js scripts rely exclusively on built-in modules, avoiding third-party dependency risks and supply chain vulnerabilities.- [SAFE]: Filesystem operations, including snapshots, restoration, and cleanup, are strictly scoped to a dedicated evaluation root (.codebase-eval) within the project. The logic includes validation in platform-utils.mjs and project-state.mjs to prevent path traversal or escapes.- [SAFE]: The framework explicitly forbids the storage of secrets or credentials in artifacts and includes redaction/cleanup policies for temporary environment state, ensuring that sensitive information is not persisted.- [SAFE]: Command execution in run-verification.mjs and run-evalset.mjs is governed by a strict protocol and includes a blocklist for package managers (refuseInstall) to prevent unauthorized dependency mutations during the evaluation process.- [SAFE]: A comprehensive suite of validation scripts (self-test.mjs, validate-evalset.mjs, validate-judgments.mjs) is provided to verify the integrity of the benchmark data, structural correspondence of bilingual outputs, and adherence to the execution protocol.

codebase-arena