The Agent Skills Directory

[SAFE]: The skill provides a methodology for product quality auditing and does not contain malicious instructions, obfuscation, or unauthorized data access patterns.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes external data (product source code, build artifacts, and test receipts) and passes information to an independent "Judge" agent. However, it employs safety-enhancing patterns such as requiring an independent agent for verification, using explicit scoring anchors, and instructing the judge to rely only on provided receipts.
[EXTERNAL_DOWNLOADS]: The skill references numerous official documentation and guideline URLs from trusted organizations (ISO, Apple, Google, W3C, OWASP). These are for informational purposes and do not involve downloading or executing untrusted code.
[COMMAND_EXECUTION]: The skill directs the agent to use standard software development and security tools such as npm audit, gitleaks, and playwright-cli to evaluate target products. These operations are within the expected scope of a QA and security auditing skill.

quality-loop