[BUG]: Tier 3 credits reading a script as executing it #153

At 5c73273 (0.3.0), check_script_execution asks only whether the expected script name appears anywhere in an execution command's text:

for call in exec_calls:
    cmd = _command_text(call)
    if expected_script in cmd:
        return {"passed": True, "score": 1.0, "reason": f"Executed {expected_script}"}

So a command that reads the script earns full execution credit:

check_script_execution(
    [{"action": "Bash",
      "action_input": {"command": "cat /workspace/skills/demo/run.py"},
      "observation": "print('hi')\nExit code 0"}],
    "run.py",
)
# {'passed': True, 'score': 1.0, 'reason': 'Executed run.py'}

head -20 run.py, echo run.py, grep -n threshold run.py, wc -l run.py and python run.py.bak return the same result. Both the host checker in eval_core/checks.py and the bundled verifier in harbor/templates/eval.py behave this way.

This looks like an oversight rather than a deliberate policy, because the same distinction is already drawn in the same file. _cmd_reads_skill_md requires a read verb and a SKILL.md filename, and its docstring says a bare word match "must not be credited". check_workflow_order excludes --help and which . #141 fixed false positives in the network exfiltration check. The script check is the one still using a substring test.

Scope: script_execution is one of four sub-checks in skill_execution, which carries 1/6 of the default composite.

Expected: only evidence of an invocation earns execution credit. Reading a script, printing its name, searching it, or running a different filename should not produce "Executed run.py".

A smaller related point: the two copies order the observation fallback differently, so an execution call that does not match can score 0.0 in the host checker and 0.75 in the bundled verifier.

I have a fix and tests ready and will open a PR against this issue.

Disclosure: I maintain Driftproof, an open-source skill evaluation tool. This came from reading this repository's source; the Driftproof runner was not used.