The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is configured to silently read sensitive authentication tokens from the local file system to authenticate with external services.
Sensitive file paths: SKILL.md instructs the agent to attempt reading credentials from ~/.folio-credentials and .env in the repository root.
Network operations: The retrieved credentials (TESTRAIL_API_KEY, JIRA_API_TOKEN, GITHUB_TOKEN) are utilized in network requests to foliotest.testrail.io, Jira, and GitHub APIs.
Concealment: The instructions explicitly direct the agent to try the credential sources "silently" and avoid prompting the user.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external Jira tickets which is then used as input for generating test cases.
Ingestion points: User stories and Jira ticket data (Summary, Description, AC) are fetched via the Jira MCP tool as described in SKILL.md.
Boundary markers: No delimiters or safety instructions are specified to separate external content from the model's logic.
Capability inventory: The agent has extensive network capabilities (API access to TestRail, Jira, and GitHub) and file-read access to its reference directory.
Sanitization: There is no mentioned validation or filtering of the external data before processing.
[EXTERNAL_DOWNLOADS]: The skill fetches project-specific metadata and translation files from remote repositories.
Details: It constructed URLs to download en_US.json and package.json files from the folio-org organization on GitHub to enrich the test case context.

write-testrail-cases