The Agent Skills Directory

[DYNAMIC_EXECUTION]: The interactive bash scripts provided with the skill (scripts/create_bug_report.sh and scripts/generate_test_cases.sh) are vulnerable to command injection.
The prompt_input function in both scripts uses the eval command to assign user input to variables: eval "$var_name=\"$input\"".
Maliciously crafted input (e.g., using $(command) or ; command;) can bypass the variable assignment and execute arbitrary shell commands on the user's system when the script is run.
Furthermore, these variables are interpolated within a heredoc (cat > "$OUTPUT_FILE" << EOF), which leads to additional shell command execution during the file generation process if the input contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external data from Figma URLs for design validation, which introduces an indirect prompt injection attack surface.
Ingestion points: External design specifications and metadata are retrieved via the Figma MCP from user-provided URLs as described in SKILL.md and references/figma_validation.md.
Boundary markers: The skill instructions do not define clear boundaries or provide "ignore embedded instructions" warnings when the agent processes content retrieved from the Figma API (such as layer names, component descriptions, or document metadata).
Capability inventory: The skill possesses the capability to write files to the local system (generating markdown reports) and instructions to use bash scripts, which could be misused if the agent is influenced by malicious instructions in a design file.
Sanitization: There is no evidence of sanitization or validation of the data retrieved from external Figma URLs before it is incorporated into the agent's context and used for further task generation.

qa-test-planner