{
  "context": "Tests whether the agent avoids eval when performing dynamic substitutions with user-supplied config values, correctly quotes variables throughout (especially multi-word values), and uses safe alternatives like sed or envsubst for template rendering.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "No eval used",
      "description": "Script does NOT use `eval` anywhere in the substitution or rendering logic",
      "max_score": 15
    },
    {
      "name": "Safe substitution method",
      "description": "Script uses sed, envsubst, awk, or another safe method for placeholder substitution (not eval or source-based variable injection)",
      "max_score": 12
    },
    {
      "name": "Multi-word values handled",
      "description": "Substitution correctly handles config values containing spaces (e.g. \"Q1 2026 Revenue Report\") without breaking the output",
      "max_score": 10
    },
    {
      "name": "Quoted variable expansions",
      "description": "Variables derived from config values are quoted when passed to commands (\"${value}\" not $value)",
      "max_score": 10
    },
    {
      "name": "Correct output produced",
      "description": "Running the script with inputs/template.txt and inputs/config.cfg produces output where all four {{KEY}} placeholders are replaced with the correct values from config.cfg",
      "max_score": 15
    },
    {
      "name": "Strict mode present",
      "description": "Script includes `set -euo pipefail`",
      "max_score": 8
    },
    {
      "name": "Env shebang",
      "description": "Shebang uses `#!/usr/bin/env bash`",
      "max_score": 8
    },
    {
      "name": "Input validation",
      "description": "Script validates that the template file and config file both exist before processing",
      "max_score": 8
    },
    {
      "name": "readonly or local constants",
      "description": "Script uses `readonly` for at least one script-level constant or `local` for function-scoped variables",
      "max_score": 7
    },
    {
      "name": "Logging or status messages",
      "description": "Script emits at least one status message (to stderr or stdout) indicating progress or completion",
      "max_score": 7
    }
  ]
}