skill-evaluation

• Analyzed: May 14, 2026, 5:01 PM
• Findings: 1
• Version: 1.0.3
• Hash: 29237dc3f63b0747198732e9c2bb7b1c4790acc3f30c4a51a02d7c85610bc50f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a framework for evaluating AI agent skills, including a safety scanner and a trigger evaluator. The script `scripts/run_trigger_eval.py` performs high-risk operations by writing temporary files into sensitive agent configuration directories (e.g., `.claude/commands/`, `.cursor/rules/`, and `.claw/skills/`) and executing platform CLI tools like `claude`, `claw`, and `codex` via `subprocess`. Although the code includes security controls such as path traversal protection (`_verify_path_containment`) and a neutralization function to strip prompt-injection patterns from descriptions, the capability to programmatically modify agent configurations and execute shell commands for testing purposes remains a significant risk.