The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the local environment to guide its behavior and generate executable test code.
Ingestion points: The agent reads changed-but-uncommitted source files, git diff outputs, Architecture Decision Records (ADRs), and design documents (SKILL.md Step 1, agent-prompt.md).
Boundary markers: There are no explicit instructions or delimiters used when reading source files to prevent embedded instructions from influencing the agent's behavior.
Capability inventory: The skill possesses 'Bash', 'Write', and 'Edit' capabilities, allowing it to execute shell commands and modify the file system (SKILL.md Step 8, writing-guide.md).
Sanitization: No sanitization or validation of the ingested source code is performed before it is used to generate new test scripts.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to perform its core functions.
Evidence: It uses git to determine the scope of changes (git diff, git ls-files).
Evidence: It runs test suites using commands defined in preferences or detected scripts (e.g., pnpm test, pytest, go test) as described in SKILL.md Step 7 and Step 8.
[REMOTE_CODE_EXECUTION]: The skill installs and executes third-party code from external registries.
Evidence: In SKILL.md Step 5 and modes/setup.md, the skill proposes installing test frameworks and addons (e.g., vitest, playwright, pytest) using package managers like pnpm, pip, and go get. While it requires user confirmation via AskUserQuestion before installation, the subsequent execution of these tools constitutes remote code execution.
[EXTERNAL_DOWNLOADS]: The skill references and downloads configuration and packages from external repositories and registries.
Evidence: It specifically references fetching the testify library from github.com/stretchr/testify using go get.

test