The Agent Skills Directory

Privilege Escalation Commands: The skill documents the use of sudo to install system-level dependencies via package managers. While this is a standard practice for environment configuration on certain operating systems, it represents a privilege escalation pattern that should be verified against organizational security policies.\n
Evidence: extensions/cpp.md provides an example for installing libraries using sudo apt-get install.\n- External Package Management and Remote Resources: The instructions guide the agent to use various package managers (e.g., npm, pip, cargo, go get, bundle, swift, nuget, apt, brew) to manage dependencies. It also describes fetching test frameworks directly from remote repositories during the build process.\n
Evidence: extensions/cpp.md includes instructions for using FetchContent to download GTest from github.com/google/googletest and Catch2 from github.com/catchorg/Catch2.\n
Evidence: extensions/powershell.md mentions installing the Pester module with the -SkipPublisherCheck flag, which bypasses publisher verification.\n- Indirect Prompt Injection Surface: The skill provides a framework for AI agents to process source code and generate tests. If the code being analyzed contains malicious instructions, there is a potential for the agent to be influenced by them during its operations.\n
Ingestion points: The agent is directed to read existing source code and test files across various languages as part of its research and implementation phases.\n
Capability inventory: The instructions authorize the agent to execute build, test, and linting commands (such as cmake, pytest, cargo test, dotnet test, go test) and to create new files in the project directory.\n
Boundary markers: The skill utilizes standard Markdown structures but does not explicitly define unique delimiters or specific instructions for the agent to ignore embedded commands within the analyzed source files.\n
Sanitization: No automated sanitization or validation of untrusted source code content is specified before the agent processes it.\n- Extensive Command Execution: The skill provides detailed commands for building, compiling, testing, and linting code across different project types. These commands interact with the local operating system and build tools as a core part of the testing workflow.\n
Evidence: Extensive command lists for cmake, make, bazel, dotnet, go test, mvnw, gradlew, pytest, rspec, cargo, swift test, and vitest are present throughout the extension files.

code-testing-extensions