The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external and potentially untrusted data, including application traces, evaluation datasets, and human labels. This creates a surface for indirect prompt injection where malicious instructions embedded in the data could attempt to influence the agent's analysis or audit results. \n
Ingestion points: Ingestion points for traces and datasets are defined in SKILL.md (Gather evidence) and references/managed.md (Inspect a real existing trace). \n
Boundary markers: The skill mentions redacting at collection boundaries (references/workflow.md) but lacks explicit delimiters for instructions. \n
Capability Inventory: The skill instructions involve writing files to the local workspace and executing evaluation runners (references/toolkit.md). \n
Sanitization: The instructions mention redacting secrets but do not describe specific sanitization for indirect prompt injection. \n- [DYNAMIC_EXECUTION]: The workspace setup script dynamically generates executable code by reading from a templates directory and applying string modifications for path configuration. \n
Evidence: scripts/setup_workspace.py reads file content from a templates folder and uses .replace('.eval/default', root.as_posix()) to inject the workspace root path before writing the files to the local directory as new Python or JavaScript scripts. \n- [COMMAND_EXECUTION]: The skill instructions frequently prompt the user to execute various Python and Node.js scripts generated during the setup process to perform evaluation tasks, server hosting, and reporting. \n
Evidence: references/toolkit.md and references/workflow.md list commands like python .eval/default/scripts/run_evals.py and python .eval/default/review-app/server.py.

eval-audit