The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes natural language data within test datasets to simulate LLM interactions. This creates a surface where malicious instructions could be embedded in test cases to influence agent behavior.
Ingestion points: Test scenarios are loaded from JSON files via loadEvalDataset('./data/host-evals.json').
Boundary markers: The skill does not implement explicit delimiters or boundary markers to isolate the scenario input from the surrounding prompt context.
Capability inventory: The test runner is capable of triggering MCP tool calls and executing shell commands (via hostType: "cli") based on the output of the LLM simulation.
Sanitization: There is no evidence of sanitization or filtering applied to the scenario field before it is processed by the LLM or used in CLI arguments.
[COMMAND_EXECUTION]: The framework supports a cli host type that executes shell commands to test agent behavior. The configuration allows the {{scenario}} placeholder to be injected directly into the args array, which could lead to command injection if the scenario text contains shell meta-characters and is not properly escaped by the underlying runner.
[DYNAMIC_EXECUTION]: The skill uses dynamic configuration to spawn subprocesses at runtime. The mcpHostConfig defines the command, arguments, and timeout for a CLI-based host simulation, providing a mechanism for runtime process creation based on external JSON definitions.

write-mcp-host-eval