The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestration scripts scripts/run_eval.py and scripts/run_judge.py utilize the subprocess module to execute external binaries including claude, codex, and git. In scripts/run_eval.py, the run_orchestrator function executes the orchestrator agent with elevated privileges using flags such as --dangerously-skip-permissions (for Claude CLI) or --dangerously-bypass-approvals-and-sandbox (for Codex), which allow the agent to perform actions without user confirmation.
[DATA_EXFILTRATION]: The script scripts/run_judge.py whitelists sensitive environment variables to be shared with sub-agent sessions. The JUDGE_ENV_WHITELIST includes ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, and SSH_AUTH_SOCK. These credentials and sockets are passed into the environment of the LLM judge sub-process.
[PROMPT_INJECTION]: The evaluation workflow creates an indirect prompt injection surface where LLM judges process artifact data (transcripts and notes) that may contain untrusted content.
Ingestion points: scripts/run_judge.py reads notes.md, agenda.md, and transcript.jsonl files generated during previous runs.
Boundary markers: Content is delimited by Markdown headers but lacks robust sanitization or specific instructions to ignore embedded commands.
Capability inventory: Judge agents run via claude -p or codex exec and have access to the whitelisted sensitive credentials.
Sanitization: There is no validation or escaping of the artifact content before it is interpolated into the judge's prompt template.
[COMMAND_EXECUTION]: stubs/_stub.py executes binaries defined by environment variables (e.g., EVALS_REAL_CLAUDE) with arguments captured during recording. While intended for replay-mode testing, this allows execution of commands from configurable system paths.
[EXTERNAL_DOWNLOADS]: SKILL.md instructs the user to install the senate skill from the same vendor using npx skills add SebastianElvis/senate to enable the evaluation functionality.

evals