The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes a "CRITICAL: NEVER pause" directive under its Autonomous Execution Policy. This instruction explicitly mandates that the agent bypass standard safety protocols and user confirmation checkpoints during execution. By overriding the default human-in-the-loop constraints, it increases the risk that the agent will perform high-impact or destructive actions without oversight.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect injection by ingesting untrusted data from external bug report files (e.g., qa-bugs/bug-*.md). These files contain natural language instructions such as "passos para reproduzir" (steps to reproduce) that the agent uses to drive its implementation and testing logic.
Ingestion points: The agent reads the bug file path provided by the user and processes its content in Step 1.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when interpolating content from the bug reports into the agent's context.
Capability inventory: The skill possesses extensive capabilities including file read/write access, directory creation, and the ability to execute shell commands through detected package managers.
Sanitization: The skill lacks sanitization or validation logic to filter out malicious instructions embedded in the reproduction steps of the bug report.
[COMMAND_EXECUTION]: The skill automatically executes project-defined scripts (e.g., npm test, typecheck) based on the detected environment. When combined with the high degree of autonomy and the processing of untrusted input files, this creates a vector for executing malicious code or commands if the project's configuration files or the bug reports themselves are compromised.

do-execute-qa-bugfix