The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md and the scripts/e2e-cleanup.sh script utilize sudo rm -rf to delete directories, which involves high-privilege file system operations that could be dangerous if paths are manipulated.
[COMMAND_EXECUTION]: The scripts/e2e-cleanup.sh script executes docker rm -f $(docker ps -aq), which is a highly destructive command that forcefully removes all Docker containers on the host system regardless of whether they belong to the test suite.
[COMMAND_EXECUTION]: The reference.md file documents steps that allow the agent to execute arbitrary shell commands and create shell scripts (e.g., execute {N} commands {cmd}, create the shell script file {name}). This capability allows for unrestricted command execution within the testing environment.
[REMOTE_CODE_EXECUTION]: The testing framework is designed to parse and execute commands specified in .feature files. This creates a direct path for code execution based on the content of external data files provided to the agent.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the processing of untrusted .feature files.
Ingestion points: The agent reads and interprets instructions from case.feature files located in the test_cases/ directory.
Boundary markers: There are no documented boundary markers or instructions to ignore embedded commands within the processed feature files.
Capability inventory: The agent has access to powerful tools including shell command execution, script creation, and privileged file deletion (sudo rm -rf).
Sanitization: No sanitization or validation logic is described for the commands or scripts extracted from the feature files before they are executed.

e2e