The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, including a user-configurable uatCommand (configured in skills-config.yaml) for running end-to-end tests, git for repository state management and commit operations, and curl for environment health probes. These commands are integral to the skill's purpose of automating UAT workflows.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external or user-provided sources to determine its actions.
Ingestion points: Content is read from the web application under test (baseUrl and apiUrl), the UAT registry file (docs/qa/uat-registry.md), and PRD story documentation (docs/prd/).
Boundary markers: The instructions do not define strict delimiters or include 'ignore embedded instructions' warnings when the agent processes data from these external sources.
Capability inventory: The skill has access to sensitive capabilities including shell command execution (uatCommand), file system writes (updating the registry and creating bug reports), and network access via curl and Playwright.
Sanitization: There is no evidence of sanitization or validation logic designed to prevent the agent from following malicious instructions that might be embedded in the test data or the application under test.

qa-next