The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script scripts/trace_evaluate.py to analyze directory contents, count files, and extract metadata from target skill folders.
[COMMAND_EXECUTION]: Instructs the agent to generate and save evaluation reports (Markdown or HTML) directly to the target skill's local directory.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection (Category 8) because the skill's primary function involves reading and interpreting untrusted documentation from external skill folders to calibrate quality scores.
Ingestion points: Reads SKILL.md and files within the references/ and examples/ directories of the skill being evaluated.
Boundary markers: Absent; the instructions direct the AI to read and process the files directly without defined delimiters.
Capability inventory: Subprocess execution for the evaluator script and file system write operations for report generation.
Sanitization: None; input content is interpreted raw for semantic evaluation.
[SAFE]: The included evaluator script contains defensive features that scan target files for hardcoded credentials (using regular expressions for API keys and tokens) and interactive shell patterns to identify security risks in analyzed skills.

skill-trace-evaluation