The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates that the agent extract and execute shell commands directly from markdown files (e.g., docs/tests/TC-*.md) found within the project repository. Section 5.2 of SKILL.md explicitly instructs the agent to "Follow the test case's... steps... EXACTLY as written" and to "not improvise or substitute commands," effectively allowing any command defined in a project file to be executed on the host or container.
[PROMPT_INJECTION]: The skill contains specific instructions designed to circumvent AI safety filters. In section 5.4, it advises the agent to use "bypassPermissions mode" when running adversarial test cases because such payloads are "often denied by the auto-mode safety classifier." It provides a strategic workaround to ensure that "adversarial runs aren't blocked," which constitutes an instruction to bypass safety constraints.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect injection as it ingests untrusted data from the repository and uses it to drive agent behavior.
Ingestion points: The agent reads test plans (docs/tests/test-plan.md) and individual test case files (docs/tests/TC-*.md).
Boundary markers: There are no markers or delimiters used to separate the skill's trusted instructions from the commands/instructions parsed from the repository data.
Capability inventory: The agent has the capability to execute shell commands, perform database queries, and initiate network requests (e.g., via curl).
Sanitization: The skill lacks any mechanism to sanitize, validate, or filter the commands extracted from repository files before they are passed to the shell for execution.
[EXTERNAL_DOWNLOADS]: The references/build-systems.md file contains instructions for the agent to run various package managers (including npm, pnpm, yarn, bun, pip, uv, poetry, cargo, go, and maven). These tools will download external dependencies from public registries during the mandatory "rebuild" phase of the testing workflow.

manual-testing