The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to drive multiple coding agent CLIs (e.g., claude, codex, agy, cursor-agent, copilot, amp, opencode, grok) in headless mode. It explicitly uses flags like --dangerously-skip-permissions, --dangerously-bypass-approvals-and-sandbox, and --always-approve to enable automated tool use without interactive confirmation. This bypasses typical agent safety prompts, though it is documented as a requirement for non-interactive evaluation.
[DYNAMIC_EXECUTION]: The scripts/run_script_checks.py script executes Python files found within the directory of the skill being evaluated. While this is a core functionality for verifying deterministic script outputs, it involves running code from the target skill folder using sys.executable.
[EXTERNAL_DOWNLOADS]: The scripts/agent_adapters.py file contains several curl | bash installation command strings for various coding agent CLIs. These URLs point to well-known and trusted services such as Anthropic, Google, Cursor, xAI, and Sourcegraph, and are provided as documentation and help text rather than being executed directly by the harness script.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from evals/evals.json in external skill directories and uses it to drive agent prompts and script execution. This creates a surface where a malicious skill under evaluation could attempt to influence the host agent's behavior.
Ingestion points: Reads evals/evals.json and script files from the target --skill directory.
Boundary markers: No explicit delimiters or boundary instructions are used when interpolating eval data into the agent's execution prompt.
Capability inventory: Uses subprocess.run to execute scripts and drive CLI agents; uses Write to create and scaffold workspace directories.
Sanitization: The harness performs basic JSON parsing but does not sanitize or escape the content of the eval prompts or script assertions before use.

skill-evaluator