The Agent Skills Directory

[COMMAND_EXECUTION]: The script references/python/run_acceptance.py utilizes subprocess.call to execute the gherkin-lint utility and os.execv to transition execution to the behave test runner. These are standard operations for CLI tools coordinating multiple development utilities. The executions are performed using direct process invocation rather than a shell environment, which effectively mitigates the risk of command injection through manipulated arguments.
[INDIRECT_PROMPT_INJECTION]: The skill processes spec.md files from the openspec/ directory to generate test features. While this ingestion surface could theoretically be targeted by indirect prompt injection, the skill employs strict boundary markers—specifically Gherkin code fences (```gherkin) and Markdown headings—governed by a normative extraction contract. This ensures that only designated test steps are processed as executable data, and the agent's capabilities remain confined to local file management and standard testing tool execution.
[SAFE]: The skill's implementation is self-contained and avoids external network requests or the execution of remote scripts. Dependencies are limited to well-known, industry-standard testing and parsing libraries. The logic for managing test specifications is clearly documented and implemented in both JavaScript and Python, ensuring maintainable and predictable behavior within the developer's environment.

acceptance-test-authoring