The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Bash to execute standard development lifecycle commands including pnpm test:coverage, pnpm audit, pnpm lint, and pnpm typecheck. These executions are routine for a QA specialist and are limited to local project scripts.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it reads external project data to map requirements to test coverage.
Ingestion points: docs/req/user-stories.md, project coverage reports, and package.json scripts.
Boundary markers: Absent; the instructions do not explicitly wrap external data in delimiters.
Capability inventory: Bash (pnpm execution), Write/Edit (creating reports and test stubs), and Task (agent invocation).
Sanitization: No explicit sanitization or filtering of the content from requirements files is specified before processing.
[SAFE]: The security verification dimension includes a local secret scan using grep to identify hardcoded passwords or API keys in the source code. This is a defensive security feature intended to assist the user and does not represent data exfiltration. The skill maintains human-in-the-loop control by using AskUserQuestion before performing any 'fix-forward' code generation.

qa