The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute test steps and project commands defined in test-cases.md. This allows for arbitrary command execution within the agent's environment, though it is gated by explicit user authorization for destructive actions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from multiple files to determine its behavior.
Ingestion points: The agent reads test-cases.md, .ai-factory/config.yaml, DESCRIPTION.md, ARCHITECTURE.md, and project-level overrides in .ai-factory/skill-context/aif-qa-check/SKILL.md.
Boundary markers: The skill lacks explicit boundary markers to separate untrusted test case instructions from system logic, relying on markdown formatting.
Capability inventory: The agent has access to Bash, Browser, Playwright, Read, and Write tools, which can be leveraged if malicious instructions are injected into the test cases or overrides.
Sanitization: While the skill includes mandatory redaction for secrets before writing output (PII and credential protection), it does not sanitize incoming instructions before execution, relying instead on user authorization for high-risk actions.
[DYNAMIC_EXECUTION]: The skill dynamically interprets and executes steps, selectors, and commands retrieved from external files at runtime, which is a standard part of its QA functionality but carries inherent risks of arbitrary instruction execution.

aif-qa-check