The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes subprocess.run to perform git operations and execute operator-defined shell hooks (e.g., COLD2_REPLACE_CMD in resources/qa_product.py). These commands are essential for simulating infrastructure events during the testing process.
[CREDENTIALS_UNSAFE]: Environment variables such as AGENTA_API_KEY, DAYTONA_API_KEY, and TELEGRAM_BOT_TOKEN are used to authenticate against the services being tested. The skill also reads credentials from a local environment file. To mitigate risk, the code includes logic to automatically redact these secrets before they are persisted in results files.
[EXTERNAL_DOWNLOADS]: The skill initiates network requests to external APIs including Daytona, Telegram, and public MCP servers to verify integration surface areas.
[INDIRECT_PROMPT_INJECTION]: The skill processes agent replies and tool outputs, creating a vulnerability surface where untrusted data enters the agent context.
Ingestion points: Raw SSE stream frames and tool output payloads are captured and analyzed in resources/qa_product.py and various matrix scripts.
Boundary markers: Prompts frequently use specific expected reply tokens (e.g., QA-CWD-), though general output processing relies on identifying specific frame types rather than strict data delimiters.
Capability inventory: The skill has access to network operations (httpx), file writing (via API commits), and local shell execution (subprocess).
Sanitization: The skill implements automated credential masking in its redact and redact_tree functions to protect sensitive information in logs.
[DYNAMIC_EXECUTION]: The test suite utilizes importlib.import_module in several files (e.g., resources/test_gate_review_followups.py) to dynamically load local modules for testing.

agent-release-gate