The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess module to execute the claude CLI and its own internal testing scripts. This is the primary mechanism for scenario generation, behavioral evaluation, and rule mutation.
Evidence: scripts/_common.py defines a claude_pipe function that invokes subprocess.run(["claude", "-p", ...]) to communicate with the model.
Evidence: scripts/mutate-loop.py invokes the eval-behavioral.py script via subprocess.run to perform A/B testing on mutated rules.
Context: Commands are constructed using lists rather than shell strings, effectively mitigating the risk of shell injection. This behavior is consistent with the documented purpose of the skill as a development and testing tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data from CLAUDE.md or other agent definition files to generate test scenarios and judge responses. This creates a surface for indirect prompt injection if a target file contains adversarial instructions designed to influence the evaluator.
Ingestion points: scripts/generate-scenarios.py reads the target file content to analyze rules.
Boundary markers: The scripts use markdown code blocks and clear system prompts to delimit user content from instructions.
Capability inventory: The skill possesses the capability to read local files, write to the filesystem (results and cache), and execute the claude CLI.
Sanitization: The tool uses JSON parsing for LLM responses and strips markdown fences from output. It includes safety guardrails such as frontmatter protection and bounded mutation checks to prevent unintended file corruption or significant instruction rewrites.

eval-agent-md