The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions require the agent to execute a local Python CLI script (qa_agent.py) using shell command templates.
Evidence: The documentation specifies commands like python "$QA_AGENT_DIR/scripts/qa_agent.py" show-knowledge --module <module>.
Risk: The interpolation of variables like <module> into the shell command represents a potential command injection vector if the input source is untrusted or contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill processes internal agent files that contain data derived from an external codebase, creating a surface for indirect prompt injection.
Ingestion points: The skill reads .qa-agent/current/context.json, .qa-agent/current/existing-case-index.json, and .qa-agent/current/risk-analysis.json (as seen in SKILL.md).
Capability inventory: The skill can write files, execute local scripts, and generate HTML for human review.
Sanitization: No explicit sanitization or escaping mechanisms for the ingested data are described before the content is interpolated into test cases or the HTML review page.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested files.
[DYNAMIC_EXECUTION]: The skill uses shell-based service discovery to locate its own executable directory path at runtime.
Evidence: SKILL.md provides a shell pipeline using find across multiple hidden home directories (~/.claude/skills, ~/.agents/skills, etc.) to locate the tool's directory.

qa-testcase-designer