The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes user-supplied information—such as evaluation names, scenarios, and prompts—which is then integrated into generated markdown, CSV, and JSON files. The agent is subsequently directed to inspect and validate these files through execution and review.\n
Evidence: The bootstrap_realtime_eval.py script accepts various user-controlled arguments (e.g., --scenario, --simulator-system-prompt, --data-path) and writes them into files like README.md and simulation templates.\n
Evidence: The SKILL.md instructions require the agent to "validate before returning" by running the newly generated evaluation commands and inspecting the resulting data files.\n
Security Consideration: If the user-provided data contains adversarial instructions, they could potentially target the agent during the automated validation or manual inspection steps.\n- Dynamic Command Generation: The skill programmatically constructs shell commands and configuration files that incorporate user-defined values, which the agent then executes to verify the setup.\n
Evidence: The build_run_commands function in bootstrap_realtime_eval.py assembles command strings for the harnesses using paths and parameters derived from the user's input.\n
Evidence: The SKILL.md workflow triggers these commands (e.g., uv run python ...) immediately after the scaffolding script completes.\n
Security Consideration: This represents a dynamic execution workflow where user-influenced strings dictate the agent's next operations. The script mitigates directory-traversal risks by validating that the output directory remains within the repository's evaluation root.\n- Local File Access: The bootstrapping script accepts a file path for input data and reads it using the pandas library without path restriction.\n
Evidence: The --data-path argument in the Python script is passed directly to pd.read_csv() to normalize or copy data.\n
Security Consideration: While intended for local evaluation data within the repository, this pattern allows the reading of arbitrary files accessible to the execution environment if an untrusted path is provided.

bootstrap-realtime-eval