The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/generate_report.py includes a generate_script method that assembles a shell script from a provided template and writes it to the output directory. It explicitly uses file_path.chmod(0o755) to make these generated scripts executable. This provides a mechanism for the agent to generate and run arbitrary shell commands on the local system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse data from external sources such as JUnit XML, Jest JSON, and pytest results. These files contain test failure messages and stack traces that are often controlled by developers or external inputs. An attacker could inject malicious instructions into these fields to manipulate the agent's behavior during report generation.
Ingestion points: The skill searches for test result files using patterns like **/junit.xml and **/test-results.json as specified in SKILL.md.
Boundary markers: There are no boundary markers or instructions defined to prevent the agent from following commands embedded within the test result data.
Capability inventory: The skill has access to file system operations (Read, Write, Edit, Glob) and command execution (Bash).
Sanitization: No sanitization or validation steps are mentioned for the external data being parsed into reports.
[COMMAND_EXECUTION]: The scripts/generate_report.py script performs file system permission changes (chmod), which is a privileged operation used here to facilitate the execution of dynamically created scripts.

generating-test-reports