The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input through its $ARGUMENTS field, specifically parsing external checklist files (.md, .json, .yaml) to extract setup commands, prerequisites, and test criteria. This architecture is vulnerable to indirect prompt injection, where malicious instructions embedded in a test matrix could influence the agent's behavior or lead to unintended command execution.
Ingestion points: Reads and parses user-provided checklist documents and feature descriptions in Phase 1.
Boundary markers: Absent; the instructions do not implement delimiters or explicit 'ignore embedded instructions' warnings for the data it processes.
Capability inventory: Significant capabilities including shell execution (Docker, Playwright, native runners), file writing (test authoring, documentation updates), and environment configuration (Phase 2, 4, 5, 7).
Sanitization: Absent; there is no evidence of validation, escaping, or filtering for content extracted from external input files before it is used to drive agent actions.
[COMMAND_EXECUTION]: The skill performs extensive shell-based environment orchestration. This includes managing containerized services via docker compose, installing browser binaries and dependencies via npx playwright install, and running database migrations or seed scripts as defined in the project's manifests.
[DYNAMIC_EXECUTION]: In Phase 4, the skill authors new test scripts matching the project's stack to fill coverage gaps and subsequently executes these generated files using native runners. This autonomous 'write-then-run' workflow is a high-privilege capability that increases the impact of potential input poisoning.

test-it