The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell commands to manage external repositories based on user-provided inputs.
Evidence: references/remote-repository.md defines command patterns like git clone --depth 1 -b branch_name <URL> and rm -rf sdk-ut-repo-....
Risk: The use of shell commands with variables derived from user input (URL and branch name) creates a surface for command injection if the agent platform does not perform strict sanitization of shell arguments.
[EXTERNAL_DOWNLOADS]: The core workflow involves downloading arbitrary code and documentation from remote Git repositories.
Evidence: SKILL.md identifies GitCode, GitHub, GitLab, and Gitee as supported platforms and provides instructions for cloning repositories from these sources.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it parses content from external, potentially attacker-controlled repositories to guide its test generation logic.
Ingestion points: Markdown files in docs/, doc/, and the project root (e.g., README.md, API docs) within the cloned repository are specifically targeted for analysis.
Boundary markers: The instructions lack explicit boundary markers or "ignore instructions" warnings for the content read from these external files.
Capability inventory: The skill has the capability to read local files, execute shell commands (git, rm), and generate code.
Sanitization: No evidence of validation or sanitization for the content of the ingested documentation files is provided in the skill logic.
[COMMAND_EXECUTION]: The skill instructs the agent to perform destructive file operations without user confirmation.
Evidence: SKILL.md states "Audit finished, automatically delete cloned remote repository, no user confirmation needed" and references/remote-repository.md specifies the use of rm -rf or Remove-Item -Recurse -Force for cleanup.

sdk-ut-boundary-generator