The Agent Skills Directory

[SAFE]: The skill does not contain any malicious patterns such as credential theft, persistence mechanisms, or privilege escalation. All functionality is provided through local Python scripts that perform deterministic text processing.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data including source code, requirements, and coverage reports. While this creates a surface for indirect prompt injection, the risk is mitigated by the skill's implementation, which relies on regex-based analysis rather than executing the ingested data. Evidence found in 'scripts/test_generator.py' and 'scripts/coverage_analyzer.py'.
[DYNAMIC_EXECUTION]: No unsafe execution functions like eval() or exec() are used. The skill parses XML and JSON using standard, safe practices within its analyzer modules.
[PROMPT_INJECTION]: The documentation and examples provided in 'SKILL.md' and 'HOW_TO_USE.md' contain only legitimate instructions for the agent and do not attempt to bypass safety filters or override system constraints.
[DATA_EXFILTRATION]: No network-capable libraries or system calls were found. The skill does not access sensitive environment variables or local credential stores.

tdd-guide