The Agent Skills Directory

[OBFUSCATION]: The file SKILL.md contains the non-printable ASCII character \x01 (Start of Heading) embedded within multiple command-line instructions. This character is placed between the script path and its arguments (e.g., qa_agent.py\x01run-with-env). This technique can be used to bypass simple text-based security filters or obfuscate command intent in logs.
[DYNAMIC_EXECUTION]: The skill is designed to automatically 'repair' product code and test infrastructure when failures are detected. The workflow includes analyzing logs, devising a fix, and applying it directly to the source files through a multi-turn loop. This automated modification of application source code presents a risk of unintended code injection or regressions if the agent misinterprets the root cause.
[COMMAND_EXECUTION]: The skill discovers its execution environment using a complex shell command involving find across multiple hidden directories (e.g., ~/.claude/skills, ~/.agents/skills). It then executes a local Python script (qa_agent.py) using this dynamically discovered path. This pattern could be exploited if an attacker places a malicious script in a directory that matches the search criteria.
[INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads instructions and data from .qa-agent/current/test-cases.json, test-spec-tasks.json, and database records via MySQL MCP.
Boundary markers: None identified; external data from JSON files and database queries is processed as direct input for test execution and code repair.
Capability inventory: The skill has the ability to execute shell commands via qa_agent.py, perform database writes via MCP, and modify local source code files.
Sanitization: No evidence of input validation or sanitization for the data ingested from test specifications or database queries before it influences command execution or code generation.

qa-test-runner