The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.call in several scripts (e.g., scripts/batch_convert_templates.py, scripts/convert_to_json.py) to modularize its conversion logic. These calls are securely implemented using a list of arguments and a hardcoded reference to the local Python interpreter (sys.executable), which prevents shell injection vulnerabilities and ensures the code only interacts with intended local helper scripts.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process user-provided bug context (descriptions, logs, evidence). While this creates an ingestion surface for untrusted data, the skill mitigates risk through its strict workflow defined in SKILL.md and prompts/bug-reporting.md. These instructions require the agent to separate facts from assumptions and follow a rigid output structure, which limits the likelihood of an attacker successfully overriding the agent's behavior via embedded instructions.
[DATA_EXFILTRATION]: No network operations or external data transmission patterns were found. The skill includes a custom xlsx_reader.py utility to handle Excel files without external dependencies, and all data processing is performed locally on the user's provided context. The presence of placeholders for tokens in evaluation files (${API_TOKEN}) is for testing purposes and does not represent actual credential exposure.

bug-reporting