The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/execute.py executes local benchmarking logic via subprocess.run. The implementation uses a list-based command structure, which is a secure practice that prevents shell injection attacks. Additionally, the skill's documentation in SKILL.md explicitly lists the expected command-line usage.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because its primary function is to ingest and process instructions from target SKILL.md files.
Ingestion points: Target SKILL.md files and evaluation sets are read from paths specified by the user or the caller, as defined in the Discovery Phase of SKILL.md.
Capability inventory: The skill has the capability to execute sub-processes via scripts/execute.py and write to the filesystem (e.g., evals/results.tsv).
Boundary markers: While the skill follows a procedural optimization loop, it lacks explicit instructions to ignore potentially malicious directives embedded within the target skill's description or metadata during the analysis phase.
Sanitization: The provided execution scripts do not include specific sanitization or filtering of the external skill content being processed.
[DATA_EXFILTRATION]: Analysis of scripts/execute.py reveals a proactive security control where sensitive environment variables (GITHUB_TOKEN, GH_TOKEN, and COPILOT_GITHUB_TOKEN) are explicitly removed before the optimization loop is executed. This prevents sub-processes from accidentally accessing or exposing the user's credentials.

continuous-skill-optimizer