The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and YAML configurations reference promptfoo, which is a well-known, open-source tool for evaluating LLM outputs. It suggests installation via npm or brew, which is standard practice for developer tools.
[COMMAND_EXECUTION]: The skill facilitates the execution of npx promptfoo eval and promptfoo view. These are core functions of the evaluation framework and are used within a developer-controlled environment for testing purposes.
[DYNAMIC_EXECUTION]: The Promptfoo configurations utilize JavaScript-based assertions (e.g., file://assertions/pii.js). These scripts are local to the skill, static, and provide deterministic validation for the LLM evaluation tasks. No untrusted remote code execution was found.
[INDIRECT_PROMPT_INJECTION]: The skill includes tasks where the agent must process natural language feedback from 'colleagues' to fix configurations. While this represents a data ingestion surface, it is the primary functional purpose of the skill (evaluating and debugging LLM workflows) and does not present an adversarial threat in this context.

promptfoo-evaluation