The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several utility scripts in the scripts/ directory (e.g., batch_convert_templates.py, convert_to_csv.py, parse_excel.py) that use subprocess.call to execute local Python conversion logic. These calls are implemented using structured lists and the current Python executable (sys.executable) without shell invocation, which is a safe practice for modular script execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted external project data, such as API specifications, user flows, and architecture diagrams, to generate testing strategies.
Ingestion points: Data enters the context through the input fields defined in prompts/automation-testing.md and the project context workflow in SKILL.md.
Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions to wrap or isolate external content from the system prompt.
Capability inventory: The agent has the capability to generate and write complex data structures to multiple file formats (Markdown, CSV, JSON, Word, XMind) using the provided helper scripts.
Sanitization: There is no evidence of input validation or sanitization routines for the data before it is processed by the agent or passed to the conversion scripts.
[PRIVILEGE_ESCALATION]: The README.md file provides one-click installation instructions for Windows that use the -ExecutionPolicy Bypass flag for PowerShell. While standard for many developer tools, this bypasses local security configurations for script execution.

automation-testing