The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains multiple red-teaming modules that implement adversarial attack strategies (e.g., Crescendo, PAIR, GOAT, and SequentialBreak) designed to bypass AI safety guidelines.
The file "src/strands_evals/experimental/redteam/strategies/goat/goat_v0.py" includes techniques such as "refusal_suppression" and "persona_modification" to influence target models.
"src/strands_evals/experimental/redteam/strategies/sequentialbreak/sequentialbreak_v0.py" provides narrative scaffolds like 'Dialog Completion' and 'Game Environment' to conceal harmful goals.
These are legitimate components of the skill's purpose as a safety testing framework, but they involve instructions that would typically be classified as injection patterns.
[DYNAMIC_EXECUTION]: The CLI component in "src/strands_evals/cli/_entrypoint.py" dynamically loads and executes Python code based on user-supplied paths or module specifications.
It uses "importlib.import_module" and "importlib.util.spec_from_file_location" to resolve entry points for the "--agent" or "--task" arguments.
This mechanism is used to load the specific agent implementations or evaluation tasks being tested.
[INDIRECT_PROMPT_INJECTION]: The skill ingests execution traces and sessions from various backends (CloudWatch, Langfuse, OpenSearch) which may contain untrusted data.
These traces are processed in "src/strands_evals/evaluators/" and interpolated into LLM prompts for evaluation purposes (LLM-as-a-judge).
While the prompts use boundary markers like "" and "" (e.g., in "src/strands_evals/evaluators/prompt_templates/case_prompt_template.py"), there is a surface for indirect prompt injection from the evaluated agent's history.

strands-evals