The Agent Skills Directory

[PROMPT_INJECTION]: The scripts/validate_judge.py script contains an indirect prompt injection surface that could allow malicious validation data to influence the judge's verdict.
Ingestion points: The script ingests untrusted content from the output field of YAML files (e.g., .kensa/labels/<judge-name>.yaml) via the load_labels function.
Boundary markers: The build_validation_prompt function uses markdown headers (## Agent Output) to delimit the ingested data, but it lacks explicit instructions to the model to ignore any instructions contained within that data.
Capability inventory: The script can make network calls to LLM providers (Anthropic or OpenAI) through the kensa.judge module.
Sanitization: There is no evidence of sanitization, validation, or escaping of the output string before it is interpolated into the final prompt in the build_validation_prompt function.

validate-judge