The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements comprehensive safeguards against accidental data exposure. The scripts/_common.py utility defines a PRIVATE_FIELD_KEYS list (including fields like email, ssn, and applicant_name) and a _scan_structure function that actively rejects any input containing these keys. Network operations are entirely absent from the codebase.
[COMMAND_EXECUTION]: The skill instructions and scripts are designed for local execution without subprocess spawning. Bash usage is explicitly limited to invoking the bundled Python scripts. The scripts themselves are dependency-free and do not utilize eval(), exec(), or other dangerous execution functions.
[EXTERNAL_DOWNLOADS]: The skill references established academic organizations and standards (e.g., DORA, CoARA, Leiden Manifesto) and the ScholarEval research project on arXiv. These are well-known scholarly resources used for framework grounding; no external code or scripts are downloaded from these sources.
[REMOTE_CODE_EXECUTION]: All logic is contained within the local Python standard library. The scripts enforce strict limits on input file size (2 MiB), JSON depth, and structure complexity to prevent resource exhaustion or exploitation through malformed data.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external JSON and CSV data, it mitigates injection risks through a strict schema validation layer. The scripts enforce identifier formats and use deterministic math for calculations, ensuring that data content cannot influence the logic flow or trigger unintended agent actions.

scholar-evaluation