The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest and analyze untrusted files from a repository (source code, tests, and build configurations) to generate and execute new tests. This creates an attack surface where maliciously crafted files in a codebase could attempt to influence the agent's behavior. \n
Ingestion points: Instructions in the extension files guide the agent to read various project files such as CMakeLists.txt, package.json, go.mod, Gemfile, and source files to identify patterns and requirements. \n
Capability inventory: The agent is instructed to use dotnet, go test, pytest, rspec, cargo, and other standard build and test tools. \n
Sanitization: The risk is inherent to the skill's primary purpose of code analysis; the skill does not specify additional sanitization or boundary markers for ingested content. \n- [EXTERNAL_DOWNLOADS]: The C++ extension guidance contains links to GitHub releases for GoogleTest and Catch2 to be used as a fallback for dependency resolution. \n
Evidence: https://github.com/google/googletest/archive/refs/tags/v1.14.0.zip and https://github.com/catchorg/Catch2/archive/refs/tags/v3.5.4.zip. \n
Note: These resources are hosted by well-known organizations and are standard tools for C++ development. \n- [PRIVILEGE_ESCALATION]: The documentation for C++ and Java extensions mentions using sudo apt-get install to install system-level testing dependencies if they are missing. \n
Evidence: sudo apt-get install libgtest-dev catch2 gcovr lcov found in extensions/cpp.md and extensions/java.md. \n
Note: This is provided as an optional manual instruction for environment setup.

code-testing-extensions