The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) due to the way it handles external data during the test-fix-rerun loop.
Ingestion points: The workflow captures terminal output from deterministic commands (e.g., npx tsx, npx tsc, npm test) and interpolates it into the task prompts of subsequent agent steps using the {{steps.<name>.output}} pattern.
Boundary markers: There are no explicit boundary markers or XML-style tags used to isolate the untrusted command output from the agent's system instructions.
Capability inventory: The agents in this workflow have the capability to execute arbitrary shell commands (via the command field in deterministic steps) and perform file system writes (during the implementation and repair phases).
Sanitization: No sanitization or filtering is performed on the command output before interpolation. An attacker who can influence the code being tested (e.g., by embedding malicious instructions in a test failure message or build error) could potentially hijack the agent's logic during the repair step.
[EXTERNAL_DOWNLOADS]: The skill references and installs external dependencies including @electric-sql/pglite and @agent-relay/sdk. These are recognized as well-known technology services or vendor-owned resources and do not pose a security risk in this context.

relay-80-100-workflow