The Agent Skills Directory

[OBFUSCATION]: The skill includes non-printable ASCII control characters (U+0001, Start of Heading) within command examples. Specifically, the character is placed between the script name and its arguments (e.g., qa_agent.py"aggregate-runs). This technique is typically used to bypass text-based security filters or to deceive the AI agent into executing commands that appear differently to the user.
[DYNAMIC_EXECUTION]: The instructions command the agent to determine the base directory for its scripts at runtime using a complex find operation across several home directories (~/.claude/skills, ~/.agents/skills, etc.). This dynamic path is then used to execute Python scripts, which is a significant security risk if those directories contain untrusted content.
[REMOTE_CODE_EXECUTION]: The dynamic path resolution mechanism allows for potential script hijacking. If an attacker can place a file in any of the searched directories that matches the naming pattern (e.g., ~/.agents/skills/quality-assurance-agent/SKILL.md), the agent will execute the attacker's script instead of the intended one, leading to code execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external JSON artifacts created by other QA tools without explicit boundary markers or sanitization logic.
Ingestion points: Reads .qa-agent/current/test-cases.json, .qa-agent/current/test-spec-tasks.json, .qa-agent/current/latest-run.json, and .qa-agent/current/code-review.json.
Boundary markers: None identified; the agent processes these files as trusted inputs.
Capability inventory: The skill executes shell commands using Python for data aggregation, integrity checks, and report rendering.
Sanitization: There is no mention of validating or escaping the content within the ingested JSON files before they are used in the reporting logic.

qa-report-generator