The Agent Skills Directory

[COMMAND_EXECUTION]: The script run-evals.py and the subsequently generated run.py utilize subprocess.run with shell=True to execute strings retrieved from the cases.md configuration file. Specifically, the fired_when and validate fields are executed as raw shell commands to check for side effects and output validity.
[COMMAND_EXECUTION]: The scaffold-evals.py script uses os.chmod to grant executable permissions (0o755) to the runner scripts it creates in the target directory.
[REMOTE_CODE_EXECUTION]: The skill enables arbitrary command execution via data parsing. If the agent is influenced by a malicious target skill through indirect prompt injection, it could be coerced into writing harmful shell instructions into the cases.md file, which are then executed when the user runs the evaluation script.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it reads and interprets the content of external skill directories (SKILL.md, scripts, references) to guide its scaffolding process.
Ingestion points: SKILL.md, references, and scripts of the target skill are read from the local file system (specified via target-skill-dir).
Boundary markers: None are present to distinguish between instructions for the builder and the content being analyzed.
Capability inventory: The skill can execute shell commands through the generated test runners and invoke the claude CLI.
Sanitization: There is no validation or escaping of the command strings extracted from Markdown files before they are passed to the shell.

skill-eval-builder