The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands extracted from the 'test.md' file using the 'Bash' tool. The execution is triggered by tags such as '[auto]' and '[smoke]' found within the test strategy files.
[REMOTE_CODE_EXECUTION]: Malicious code placed in the 'test.md' file within a project can be executed by the agent, leading to a full compromise of the environment.
[DATA_EXFILTRATION]: The skill implements an 'append-per-step' logging mechanism that records the full 'stdout' and 'stderr' of all executed commands into files under the 'test-logs/' directory. This records environment variables and potentially sensitive data into persistent files on the system, as shown by the example command 'printenv ANTHROPIC_API_KEY' in the reference documentation.
[DATA_EXFILTRATION]: The 'change-id' argument is used directly in file path construction (e.g., 'openspec/changes/{change-id}/tasks.md') without validation or sanitization, making the skill vulnerable to path traversal attacks that could expose files outside the intended project scope.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through external data. 1. Ingestion points: 'openspec/changes/{change-id}/tasks.md' and 'openspec/changes/{change-id}/test.md'. 2. Boundary markers: No boundary markers or 'ignore' instructions are used when processing these files. 3. Capability inventory: 'Bash' (command execution), 'Read' (file access), 'Edit' (writing logs and task status). 4. Sanitization: No sanitization or validation is performed on the commands fetched from the project files or the input arguments.

openspec-test