The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions describe an automated multi-phase workflow but explicitly mandate a Phase 3 manual approval gate. The agent must stop and wait for explicit user approval of the test plan before proceeding to the generation of any test cases or export files.
[COMMAND_EXECUTION]: The skill utilizes bundled Python scripts (export_to_xlsx.py and build_postman_collection.py) to convert generated test cases into Excel and Postman formats. These scripts are self-contained, use standard libraries for data transformation, and do not perform arbitrary system commands or network operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external requirement documents (PDF, DOCX, XLSX, etc.). While this presents a potential attack surface for embedded instructions, the risk is mitigated by the requirement for the agent to present a test plan for manual review and approval before acting on the content.
[CREDENTIALS_UNSAFE]: The script build_postman_collection.py features a security-positive mechanism that scans generated requests for patterns matching sensitive credentials, such as JWTs, AWS keys, and Slack tokens. It is programmed to refuse builds that contain hardcoded secrets, ensuring that generated collections remain safe for sharing.
[EXTERNAL_DOWNLOADS]: The skill includes a link to the vendor's informational website at casely.digital. This is a legitimate reference to the hosted version of the tool and does not involve automated downloads or execution of external code.

casely