The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses aggressive persona-adoption and instruction-override patterns. The references/master_qa_prompt.md and references/llm_prompts_library.md files contain instructions such as 'You are a senior QA engineer with 20+ years of experience at Google', 'CRITICAL INSTRUCTIONS', and 'MANDATORY RULES'. These are designed to override the agent's default behavior and safety constraints to ensure strict adherence to the skill's workflow.
[COMMAND_EXECUTION]: The skill's primary feature, 'Autonomous Execution', instructs the agent to read test specifications from markdown files (e.g., 02-CLI-TEST-CASES.md) and execute the commands listed within them. This creates a significant risk where the agent may execute arbitrary and potentially malicious shell commands if the test case files are modified by an untrusted source.
[REMOTE_CODE_EXECUTION]: The onboarding and execution guides (e.g., references/day1_onboarding.md) instruct the agent to run commands like git clone, pnpm install, and npx supabase start. While these are standard developer tools, the skill facilitates the execution of remote code and third-party packages without implementing any verification or integrity checks on the sources.
[METADATA_POISONING]: The skill includes a file named .security-scan-passed which claims a security scan was successful. This is a deceptive practice intended to influence the safety evaluation of the skill and bypass manual or automated security reviews.
[INDIRECT_PROMPT_INJECTION]: The autonomous testing workflow (Category 8) is highly susceptible to indirect prompt injection. An attacker who can influence the project files (test cases, CSV trackers, or metrics baselines) can inject malicious instructions that the agent will execute while performing its 'Senior QA Engineer' role. The skill lacks boundary markers or sanitization logic to distinguish between test data and control instructions.

software-testing-guide