The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including web pages, API endpoints, and command outputs, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via the navigate and evaluate actions (web content), request action (API responses), and shell actions (command output).
Boundary markers: There are no technical delimiters or explicit instructions to treat external data as untrusted, which could lead the agent to follow instructions embedded in test targets.
Capability inventory: The skill possesses powerful capabilities across all its scripts, including arbitrary shell command execution (shell, command), network requests (request), and file system writes (saving reports and scenarios).
Sanitization: No sanitization, escaping, or filtering of ingested data is mentioned or implemented in the instructions.
[COMMAND_EXECUTION]: The skill's fundamental design involves executing shell commands to perform QA tasks. It supports complex operations like /qa loop which involves a test-fix-regression cycle, allowing the agent to both modify code and execute it. While intended for legitimate software testing, this functional requirement provides a significant attack surface.

qa