The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md include a command that pipes a remote shell script directly into the shell: curl -sSfL https://raw.githubusercontent.com/jorgemuza/orbit/main/install.sh | sh. This allows for unverified code execution from a remote source.
[EXTERNAL_DOWNLOADS]: The skill downloads resources from GitHub repositories (jorgemuza/orbit, jorgemuza/tap, jorgemuza/scoop-bucket) during the installation process for the orbit CLI.
[COMMAND_EXECUTION]: All primary functions of the skill are implemented via shell commands using the orbit (aliased as qm) utility. This includes project listing, folder management, and test case manipulation.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from Jira issues to generate test cases. * Ingestion points: Data enters the agent context via the orbit jira issue view command. * Boundary markers: No delimiters or warnings are used to isolate the ingested Jira content from the agent's instructions. * Capability inventory: The skill can execute shell commands (orbit qm tc create) and interact with the QMetry API. * Sanitization: There is no evidence of sanitization or validation of the acceptance criteria before they are interpolated into test case creation commands.

qmetry