The Agent Skills Directory

Controlled Subprocess Execution: The skill uses subprocess.run within its Python components (import_corpus.py and test suites) to invoke local utility scripts for safety linting and environment verification. These calls utilize specific, locally resolved paths to ensure only intended logic is executed, which is a standard pattern for multi-language skills to coordinate between components.
Input Data Ingestion Surface: The skill features a 'corpus-import' mode that reads data from external CSV and XLSX files in scripts/import_corpus.py. To protect against indirect prompt injection or schema confusion, the skill applies strict normalization and utilizes standard serialization libraries to ensure that untrusted data is correctly escaped before being included in generated YAML output. Specifically, it uses json.dumps for YAML scalar encoding to provide robust boundary separation.
Safety Taxonomy Enforcement: A comprehensive set of regular expressions is maintained in references/refusal-taxonomy.md to identify and block potentially malicious or policy-violating prompts (e.g., jailbreaks, PII extraction). This proactive filtering, implemented in scripts/Lint-VallyTestSafety.ps1, significantly reduces the risk of the skill being misused to generate adversarial payloads.
Standard Dependency Usage: The skill utilizes well-known Python packages such as openpyxl and pyyaml sourced from official registries. These dependencies are used for routine data processing and testing tasks and do not introduce unexpected network or system behaviors.

vally-tests