The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute various project-level commands such as npm test, build, lint, and typecheck. It also allows for custom command execution via a scenario matrix to verify software behavior.
[DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to generate temporary tests, scripts, and harnesses at runtime to exercise behavioral scenarios. This involves writing and executing code (e.g., .py, .js, .sh) generated based on the repository context and user-defined goals. While this is the intended functionality of the QA tool, it represents a dynamic execution surface.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface by processing untrusted data from the repository and user-supplied goal arguments to drive its logic.
Ingestion points: Goal arguments, repository context files, and the scenario matrix (SKILL.md).
Boundary markers: Absent; there are no explicit delimiters or instructions to ignore embedded instructions within processed repository files.
Capability inventory: The skill utilizes skill://exec to perform subprocess calls, file writes, and script execution across all defined cycles.
Sanitization: The skill does not specify explicit sanitization or escaping mechanisms for external content before interpolation into test harnesses.

ultraqa