The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external API contracts to generate executable test code, creating a surface for potential instruction injection through malicious contract data.\n
Ingestion points: The skill reads API contracts (OpenAPI) from the qa-api-contract-curator tool or existing endpoint specification files as defined in SKILL.md.\n
Boundary markers: There are no explicit instructions or markers to distinguish between data and instructions within the ingested contracts.\n
Capability inventory: The skill is designed to generate JavaScript and Python test files that perform HTTP requests and can interact with a Pact Broker.\n
Sanitization: No sanitization or validation logic is specified to prevent untrusted contract content from influencing the generated test structure or logic.\n- [DATA_EXFILTRATION]: The skill documentation includes commands and configurations for communicating with a Pact Broker, which constitutes network operations to non-whitelisted domains.\n
Evidence: references/config.md provides examples for pact-broker publish and pact-broker can-i-deploy which target external URLs defined in PACT_BROKER_BASE_URL.\n- [DYNAMIC_EXECUTION]: The skill generates JavaScript and Python test scripts based on API definitions, which are subsequently executed in the local environment.\n
Evidence: SKILL.md describes generating Jest/Vitest (JS) and pytest (Python) files as primary output.

qa-pact-writer