The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads project-specific configuration and documentation files to determine which shell commands to run for testing, coverage, and linting. This creates an attack surface where malicious instructions or commands embedded in these files (e.g., package.json, Makefile, CLAUDE.md) are executed by the agent.
Ingestion points: Project configuration files (package.json, pyproject.toml, Makefile), documentation (CLAUDE.md), and source code files.
Boundary markers: No specific delimiters or "ignore" instructions are used when reading or interpolating discovered commands.
Capability inventory: Bash tool for shell command execution, Write for file creation, and WebFetch for potential network access.
Sanitization: No validation, escaping, or filtering is performed on the commands discovered from the file system before they are passed to the Bash tool.
[COMMAND_EXECUTION]: The skill's workflow is centered around executing shell commands (discovery in Step 0.2, baseline in Step 1.2, verification in Phase 4, and the Stop hook). These commands are derived dynamically from the environment, leading to potential arbitrary command execution if the environment contains malicious configuration.
[DYNAMIC_EXECUTION]: The skill generates executable test scripts at runtime based on analyzed source code and then runs these scripts. While this is the core functionality, the execution of dynamically generated code is a notable security pattern.

test-suite