The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes packaged Node.js scripts (radar-chart.js and generate-html-report.js) to generate visual reports. These scripts are internal to the skill and utilize standard built-in modules.
[PROMPT_INJECTION]: The skill incorporates a dedicated 'Safety & Compliance' assessment dimension that explicitly tests the agent's ability to identify and refuse harmful instructions, such as generating exploit code.
[SAFE]: A 'Self-Evaluation Integrity Protocol' is implemented, which applies a -5% global correction to self-judged scores to counteract leniency bias, ensuring more realistic capability profiling.
[SAFE]: The HTML report generation logic includes an escapeHtml function to sanitize agent-generated answers and question text, mitigating potential cross-site scripting (XSS) risks in the final assessment reports.
[DATA_EXPOSURE_&_EXFILTRATION]: Exam results and session data are stored locally in the results/ directory. The skill does not perform unauthorized network operations or exfiltrate sensitive information.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads historical data from results/INDEX.md and session JSON files for trend analysis.
Boundary markers: Uses clear role-switching instructions ('Examinee' vs 'Examiner') to maintain logical separation during the self-test process.
Capability inventory: Local file I/O (read/write in the results folder) and execution of internal Node.js utility scripts.
Sanitization: All dynamic content in HTML reports is sanitized via character escaping.

botlearn-assessment