The Agent Skills Directory

[COMMAND_EXECUTION]: The interactive bash scripts scripts/generate_test_cases.sh and scripts/create_bug_report.sh use the eval command to dynamically assign variables based on user input. Specifically, the prompt_input function executes eval "$var_name=\"$input\"", which allows for arbitrary shell command execution if a user provides input containing shell metacharacters (e.g., backticks or dollar-sign subshells).
[PROMPT_INJECTION]: The skill processes untrusted external data from user-provided requirements and Figma design specifications through the Figma MCP integration.
Ingestion points: Feature descriptions provided in natural language; UI specifications fetched via Figma MCP in SKILL.md (Figma Validation section).
Boundary markers: The templates do not utilize specific delimiters or instructions to treat external data as untrusted content.
Capability inventory: The skill executes local shell scripts and performs file-write operations (cat > "$OUTPUT_FILE").
Sanitization: There is no evidence of validation or sanitization of the data before it is interpolated into the test case or bug report generation process.

qa-test-planner