The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the repository's planning and test files.
Ingestion points: Reads requirement descriptions from .planning/SPEC.md, tasks from .planning/PLAN.md, and scans existing test files.
Boundary markers: The skill uses markdown headers and natural language instructions to separate processing phases but lacks technical delimiters to isolate external data from internal logic.
Capability inventory: The skill and its subagent possess the ability to read, write, and edit files, and execute shell commands via Bash.
Sanitization: No explicit validation or sanitization is performed on the content of the project files before they are used to influence the agent's testing plan.
[COMMAND_EXECUTION]: The skill performs several shell operations to detect project infrastructure and run tests.
Infrastructure scanning: Uses ls and fd to locate configuration files and test directories.
Test execution: Runs the project's native test commands (e.g., npm test, pytest, cargo test) as detected in the environment.
Security hooks: Executes an internal guardrail script using uv run python3 to monitor and restrict tool usage during write operations.

dev-test-gaps