The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run to call curl as a fallback transport layer for API requests. This is done to handle corporate TLS-inspecting proxies that the Python standard library might reject. The implementation is secure, using argument lists to prevent shell injection and passing the API key via stdin to curl --config - to ensure the sensitive token does not appear in system process listings (e.g., ps).
[INDIRECT_PROMPT_INJECTION]: The skill ingests data in the form of JSON filter specifications. While these specs influence the API requests, the risk is mitigated by a structured workflow that mandates a 'dry-run' first. The agent is instructed to show the dry-run results to the user and wait for explicit confirmation before proceeding with the --create command.
[DATA_EXPOSURE]: The script handles a sensitive TESTMO_API_KEY. It includes a _redact function to strip the key from any error messages or logs and performs a safety check (_check_key) to ensure the key doesn't contain characters that could be used for injection into the HTTP header or command configurations.

creating-test-runs