The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs an automated download and installation of the @metaharness/darwin package using npm install if the library is not found locally. This installation is directed to a local cache directory (~/.ruflo/darwin-cache-0.8.0).
[DYNAMIC_EXECUTION]: The skill uses dynamic imports (import()) to load and execute code from the @metaharness/darwin package. This occurs after either local resolution or the fallback installation, leading to the execution of code fetched at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as genome JSON files and run transcripts, to render system prompts and classify failure modes. This creates an attack surface where malicious instructions embedded in the input files could influence the agent's subsequent behavior.
Ingestion points: Data is ingested from files specified by the --path and --transcript arguments in the scripts/gepa.mjs script.
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions for the processed content.
Capability inventory: The skill is permitted to use Bash (via allowed-tools) and executes Node.js code.
Sanitization: No sanitization or validation of the genome's prompt content is described before it is rendered for the agent's use.

harness-gepa