The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts in the scripts/ directory, such as convert_to_csv.py, convert_to_excel.py, and parse_word.py, use subprocess.call to invoke other local Python scripts (e.g., convert_formats.py). While these scripts use a list of arguments rather than a shell string—which mitigates shell injection risks—they pass sys.argv[1:] directly to the underlying scripts. This design could be vulnerable to argument injection if the AI agent is manipulated into providing malicious flags or parameters as part of the command execution flow.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process project documentation and data in various formats (Word, Excel, CSV, JSON, Markdown) to determine the appropriate testing strategy. This ingestion of untrusted external content creates a surface for indirect prompt injection where malicious instructions inside project files could attempt to override the routing logic.
Ingestion points: Data extraction from files via scripts/parse_formats.py, scripts/xlsx_reader.py, and scripts/convert_formats.py.
Boundary markers: No specific boundary markers or delimiters are defined in the routing prompt to isolate the parsed file content from the agent's core routing instructions.
Capability inventory: The skill possesses the capability to read local files and execute local utility scripts via subprocesses.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the content extracted from processed files before it is analyzed by the agent, increasing the risk that embedded instructions could be followed.
[EXTERNAL_DOWNLOADS]: The README.md file contains installation commands for macOS, Linux, and Windows that execute shell and PowerShell scripts located within the repository (install-skills-mac.sh and install-skills-windows.ps1). The Windows command specifically utilizes -ExecutionPolicy Bypass. While these scripts are part of the skill's own package, the pattern of executing scripts with bypassed security policies is a noteworthy attack surface if the repository were compromised.

discover-testing