The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes multiple external project files to influence the test generation behavior of subagents.
Ingestion points: The skill reads configuration and documentation files including package.json, composer.json, pyproject.toml, go.mod, Cargo.toml, AGENTS.md, and CLAUDE.md, as well as the target source code.
Boundary markers: Absent. The skill instructions do not define clear delimiters or warnings to prevent the agent from obeying instructions embedded within these files.
Capability inventory: The skill has access to Write, Edit, Bash, and TaskCreate tools, allowing it to modify the filesystem and execute commands.
Sanitization: Absent. The skill does not perform validation or escaping of the content read from files before interpolating it into the prompt for the general-purpose subagent.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute discovery and analysis commands.
Evidence: The skill uses shell commands like cat, jq, grep, ast-grep, fd, and rg to extract framework information and function signatures. This represents a capability surface that relies on the agent's ability to handle potentially malicious filenames or file contents safely.
[DYNAMIC_EXECUTION]: The skill implements a dynamic preloading mechanism that loads specific sub-skills based on the file extension of the target.
Evidence: In Step 4 of SKILL.md, the agent is instructed to preload various sub-skills (e.g., skills/typescript-ops/SKILL.md, skills/python-pytest-ops/SKILL.md) based on path matching. While these are internal relative paths, the dynamic assembly of the execution context is a form of runtime configuration loading.

testgen