The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses an LLM to generate Python verification snippets (verify_py) which are then executed on the host system via subprocess.run in brief.py and judge.py to check task success.
[PRIVILEGE_ESCALATION]: The run_eval_harbor.sh script utilizes sudo to manage Docker containers via the Harbor framework, allowing it to inject skills and retrieve logs from root-owned container directories.
[CREDENTIALS_UNSAFE]: The runner scripts access sensitive credential files at ~/.claude/.credentials.json and ~/.codex/auth.json to extract OAuth and session tokens for use in containerized evaluation runs.
[COMMAND_EXECUTION]: The orchestration scripts (forge.sh, run_eval.sh, deploy.sh) frequently invoke shell commands and external CLI tools like claude, codex, and harbor using subprocess.run and bash to manage the evaluation lifecycle.
[DATA_EXFILTRATION]: The deploy.sh script transmits the skill's code and assets to a remote host via scp. While intended for deployment, this constitutes network transfer of local files.
[INDIRECT_PROMPT_INJECTION]: The judge.py component incorporates untrusted agent outputs (final messages and file lists) directly into the prompt for the judging LLM, creating a vulnerability surface where a malicious agent output could influence the evaluation verdict.

skill-eval-loop