The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs the @metaharness/darwin library via npm install if it is not detected in the local environment. These files are stored in a versioned cache directory at ~/.ruflo/darwin-cache-0.8.0. This mechanism ensures the auditing tools remain available for the agent.
[COMMAND_EXECUTION]: The skill uses Bash to execute a local JavaScript utility (scripts/gepa.mjs). This utility performs genome validation, system prompt rendering, and failure mode analysis on transcripts.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted external data from genome files (.json) and run transcripts. This data is used to generate system prompts or audit results. However, the scope of these operations is restricted to the intended purpose of the library exports, and the skill includes validation steps (--op validate) to check for structural integrity.

harness-gepa