The Agent Skills Directory

[SAFE]: The skill is a diagnostic tool for calculating retrieval and citation metrics (Recall, MRR, etc.) from deterministic JSONL files. Analysis of the source code confirms it performs only synchronous logical operations and local file reading as requested by the user.
[DATA_EXPOSURE_AND_EXFILTRATION]: No network access or sensitive path access detected. The script scripts/evaluate-rag.mjs reads a user-specified input file using node:fs/promises but does not exfiltrate data.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns or third-party dependencies were found. The tool relies exclusively on the Node.js standard library.
[INDIRECT_PROMPT_INJECTION]: The skill processes external JSONL data but is not vulnerable to instruction injection because it treats the data as literal identifiers for mathematical comparison and does not execute it or feed it back into an LLM context.
Ingestion points: The parseCases function in scripts/evaluate-rag.mjs reads data from a local file path provided via CLI arguments.
Boundary markers: The data is strictly parsed as JSON; the script enforces a schema where relevant fields must be arrays of strings.
Capability inventory: The skill lacks network tools, file-writing capabilities (outside of the test environment), and shell execution functions.
Sanitization: Validation logic ensures that input IDs are non-empty strings and that JSON structure is valid before processing.

rag-evaluation-harness