The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the Maven and Gradle wrappers (e.g., ./mvnw test, ./gradlew test) to discover project structures and validate generated test scenarios.
[DYNAMIC_EXECUTION]: The ObjectSteps library provided with the skill uses reflection (java.lang.reflect.Method.invoke) to execute methods on objects based on string identifiers defined in Gherkin .feature files, enabling dynamic code execution at runtime.
[DATA_EXFILTRATION]: The skill provides the capability to access and manipulate system environment variables and properties through the _env and _properties context objects in the ObjectSteps class, exposing potentially sensitive configuration data to the test environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied natural language specifications to generate executable Gherkin scenarios. This workflow is vulnerable to indirect prompt injection if a malicious specification is provided, potentially leading the agent to generate tests that abuse the framework's reflection or file-writing capabilities.
Ingestion points: Functional specifications provided by the user (SKILL.md).
Boundary markers: None identified in the main instructions for specification ingestion.
Capability inventory: Includes shell command execution (mvnw, gradlew), file writing (output_in), and reflection-based method invocation (callMethod).
Sanitization: Path normalization and validation are implemented in the output_in step to prevent directory traversal outside of the resource folder.

java-tests-tzatziki