The Agent Skills Directory

[SAFE]: The skill implements strong security defaults for its reporting functionality. The report generators in templates/report.py and templates/report.mjs explicitly escape all untrusted inputs and outputs using standard HTML escaping to prevent cross-site scripting (XSS) when viewing evaluation results.
[SAFE]: The artifact validation script scripts/artifacts.py includes proactive path traversal protections. It enforces that file references remain within the evaluation bundle's root directory and forbids absolute paths or parent directory traversal (..).
[SAFE]: Network operations in templates/upload_results.py and templates/upload-results.mjs are restricted to the vendor's official domains (api.confident-ai.com and eu.api.confident-ai.com). These tools are used for the intended purpose of uploading evaluation metrics to the Confident AI platform and rely on user-provided API keys stored in environment variables rather than hardcoded secrets.
[DYNAMIC_EXECUTION]: The evaluation runners (run_evals.py and run-evals.ts) use dynamic loading to execute local project files, such as application adapters and grader definitions. This is a core requirement for the skill's purpose of testing local code. The implementation uses standard runtime mechanisms (importlib in Python and dynamic import() in Node.js) to load these user-supplied local modules.
[COMMAND_EXECUTION]: The skill uses shell commands (e.g., git rev-parse HEAD) to capture the current state of the application repository for result reproducibility. This behavior is standard for development tools and is used to uniquely identify the version of the code being evaluated.

eval-run