The Agent Skills Directory

[SAFE]: The skill implements a highly structured workflow for QA management. It does not exhibit malicious patterns such as obfuscation, credential harvesting, or unauthorized network access. The use of project-specific directories for state management (e.g., production/qa/) is consistent with its stated purpose.
[COMMAND_EXECUTION]: The skill utilizes the Task tool to delegate specialized work to subagents (gamedev:qa-lead and gamedev:qa-tester). These subagents are project-internal resources used for strategy and test case generation. The orchestration logic includes explicit AskUserQuestion gates at every phase transition, ensuring that the primary agent cannot proceed without user verification of the subagents' outputs.
[INDIRECT_PROMPT_INJECTION]: The skill identifies and ingests external project data, including story files, backlog tasks, and Game Design Documents (GDD). While processing untrusted project files is a potential attack surface, the risk is mitigated by the human-in-the-loop requirement for all generated plans and reports.
Ingestion points: Story files (via Glob), GDD acceptance criteria, and milestone tasks (via mcp__backlog__task_list).
Boundary markers: The skill does not explicitly define delimiters for external content in subagent prompts.
Capability inventory: Write operations to project documentation paths, subagent spawning via Task, and task creation/viewing via backlog MCP tools.
Sanitization: The skill relies on user review via AskUserQuestion rather than programmatic sanitization of the input documents.

team-qa