The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes test commands via the test-validator subagent. This behavior is guarded by the scripts/check-test-command.sh script, which enforces a strict allowlist of known test runners (such as pytest, npm test, cargo test) and explicitly rejects shell metacharacters like ;, &, |, and backticks to prevent command injection attacks.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation and testing principles from external HTTPS sources. These are limited to a pinned allowlist of well-known and trusted domains, including owasp.org, testing.googleblog.com, martinfowler.com, and official documentation sites for testing frameworks like jestjs.io and playwright.dev. These downloads are used solely for informational purposes to guide the refactoring process.
[INDIRECT_PROMPT_INJECTION]: Because the skill processes untrusted test files, it possesses an attack surface for indirect prompt injection. This is mitigated by a comprehensive untrusted-content-policy.md which instructs subagents to treat all file content as data rather than instructions. (1) Ingestion points: TARGET_TEST_FILES input. (2) Boundary markers: Present in references/untrusted-content-policy.md, requiring agents to quote and report instruction-like content as a risk instead of obeying it. (3) Capability inventory: File system write access via test-refactorer and shell command execution via test-validator. (4) Sanitization: Command strings are sanitized through scripts/check-test-command.sh by rejecting shell metacharacters.

improving-test-suites