The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local script, scripts/score.py, to calculate evaluation results. Analysis of the script confirms it is a benign utility that performs basic arithmetic and grade mapping without network access or sensitive file operations.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it is designed to ingest and process untrusted data from external skill files.
Ingestion points: The skill reads files from a user-provided directory path (target), specifically targeting SKILL.md and referenced files for analysis.
Boundary markers: The instructions do not define explicit boundary markers or delimiters to isolate the content of the target skill from the agent's instructions, increasing the risk that the agent may follow instructions found within the audited content.
Capability inventory: The agent has the capability to execute shell commands (running the scoring script) and write output to the filesystem (output parameter).
Sanitization: The scoring script provides a degree of sanitization by attempting to cast inputs to floating-point numbers, which would cause a failure if non-numeric command injection strings were passed as score/weight arguments. However, this does not prevent instructions in the target skill from influencing the agent's logic before the scoring step.

skill-evaluation