The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/eval_dataset.py invokes the lm_eval library as a subprocess to perform model evaluations. The skill utilizes subprocess.Popen with arguments provided as a list, which effectively mitigates shell injection risks. However, user-provided values like model identifiers are incorporated into the tool's command-line arguments.
[EXTERNAL_DOWNLOADS]: The skill is configured to download necessary Python dependencies (such as datasets and transformers) through pixi.toml and retrieves evaluation datasets from Hugging Face at runtime. These operations target established, reputable services and are expected behaviors for a benchmarking utility.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes external dataset content. Evidence chain: 1) Ingestion point: Dataset items are loaded from Hugging Face in scripts/_eval_tasks.py. 2) Boundary markers: The skill appends task-specific instructions to prompts, but lacks formal delimiters or escaping for dataset content. 3) Capability inventory: The skill can execute subprocesses (lm_eval), perform network requests (urllib.request), and write results to the local filesystem. 4) Sanitization: External dataset data is interpolated into prompts with minimal sanitization. While typical for evaluation tasks, this surface could be exploited if a dataset source were compromised to influence evaluation results.

eval-model