The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external inputs such as requirement documents and code repositories to build test models and strategies. This ingestion surface is vulnerable to instructions embedded within the data.
Ingestion points: The skill reads external "需求材料" (Requirement materials) and "代码仓库" (Code repositories) as listed in the '启动：意图识别与路由' section.
Boundary markers: There are no explicit instructions to the agent to ignore potentially malicious content or use delimiters when processing these files.
Capability inventory: The orchestration includes calling skills for automated-e2e-testing and api-testing, which execute shell scripts and code (SKILL.md, Stage 5).
Sanitization: The instructions do not describe any sanitization or validation of the text content extracted from project files.
[COMMAND_EXECUTION]: The pipeline facilitates the execution of local scripts and automated test suites, which could be exploited if malicious code is introduced into the project structure.
Evidence: Stage 5 ("执行") describes executing code or scripts from the playwright/ directory and API testing scripts.
Evidence: The '断点检查' (Breakpoints) section involves running a local Python script validate_schema.py to verify file integrity.
Context: These executions are gated by human-in-the-loop checkpoints (⏸), such as the execution strategy decision, which reduces the risk of unauthorized or harmful command execution.

qa