The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands, including langwatch CLI for documentation and project operations, npx for installing additional skills or reporting tools, and environment-specific runners like pnpm exec tsx or jupyter nbconvert to execute generated experiment scripts.
[EXTERNAL_DOWNLOADS]: Fetches documentation and project indices from external domains (e.g., langwatch.ai) and downloads tools/skills via npx (e.g., npx skills@1.5.19 add langwatch/skills/online-evaluations).
[DATA_EXFILTRATION]: Contains instructions to use npx langwatch report, which transmits data (including session transcripts if --session is used) to the vendor's infrastructure. The skill includes safeguards such as requiring --user-approved and mentioning local scrubbing of API keys and PII.
[CREDENTIALS_UNSAFE]: The skill requires the agent to access and utilize LANGWATCH_API_KEY from .env files. However, it includes explicit instructions to the agent to never print, copy, or send the key, and to let the CLI handle the value directly.
[DYNAMIC_EXECUTION]: The workflow involves generating Python or TypeScript code snippets based on the user's project and then executing those scripts to run benchmarks and experiments.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it ingests untrusted data from the local project (code, system prompts, git history) and external documentation, which then influences code generation and execution.
Ingestion points: Project source code, system prompts, tool definitions, git logs, and remote documentation from langwatch.ai.
Boundary markers: Absent. The skill does not define specific delimiters or instructions to ignore instructions embedded within the ingested code or documentation.
Capability inventory: File read/write access, subprocess execution (shell, python, node), and network access (CLI API, documentation fetching, reporting tool).
Sanitization: The reporting tool (langwatch report) performs local scrubbing of common secret patterns, but no general sanitization is applied to other ingested project data before use in prompts.

experiments