The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to identify and execute arbitrary shell commands, build scripts, and local binaries found within the target repository (e.g., via Dockerfiles, Makefiles, or Procfiles). It explicitly mandates following the repository's own 'runbook' instructions, which could lead to the execution of harmful code if the repository is malicious.
[REMOTE_CODE_EXECUTION]: Since the skill can target repositories by URL, it effectively downloads and executes code from remote sources. The agent is directed to run whatever it discovers in the repository to 'bring up' the application or execute tests.
[CREDENTIALS_UNSAFE]: The 'Discovery' phase (Phase 1) specifically directs the agent to look for authentication recipes, environment variable samples (including .env files), and 'secret-injection wrappers' to facilitate its QA tasks. This creates a high risk of sensitive data exposure.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it processes untrusted content from the repository (README files, feature specs, CLAUDE.md) to determine its planning and execution logic.
Ingestion points: Phase 1 (Discovery) reads repository-supplied documentation, configuration, and source code.
Boundary markers: None. The skill does not use delimiters or instructions to ignore embedded directives in the files it reads.
Capability inventory: The skill has access to shell command execution, file system operations, and network requests to target instances.
Sanitization: There is no evidence of sanitization or validation of the instructions or criteria discovered within the repository.

autoqa