The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation includes the command echo $ZENTAO_TOKEN as a troubleshooting step for authentication errors in SKILL.md. If the agent executes this instruction literally, the sensitive authentication token will be printed to the output, exposing it to unauthorized viewing or persistent logging.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external ZenTao instance through commands like testcase get and testcase list. This data, which includes test case titles and steps, is interpolated into the agent's context without boundary markers or sanitization, creating a vulnerability to malicious instructions embedded in the test cases.
Ingestion points: Data is retrieved from the ZenTao API via zentao-cli as documented in SKILL.md and zentao-testcase-get.md.
Boundary markers: The instructions do not define clear delimiters or warnings to ignore embedded instructions for the external data.
Capability inventory: The skill allows the agent to create, update, and delete data on the ZenTao server using zentao-cli.
Sanitization: There is no evidence of filtering or escaping logic for the retrieved strings.
[COMMAND_EXECUTION]: The skill operates by executing the zentao-cli binary. While this is the intended functionality of the skill, it provides the agent with the ability to execute shell commands that interact with the system environment and the network.

zentao-testcase