The Agent Skills Directory

[SAFE]: The skill operates entirely within the provided context, requiring specific inputs like test strategies and requirements. It does not perform network operations, access sensitive file paths, or attempt to execute arbitrary code.
[PROMPT_INJECTION]: Analysis of instructions (SKILL.md and prompts/test-strategy-review.md) shows no attempts to bypass safety filters or override agent behavior. Instead, it includes strict instructions to follow the established review specification and avoid inventing data.
[DATA_EXPOSURE]: The skill does not access sensitive local files (e.g., .ssh, .aws) or hardcoded credentials. It manages project-related data (owners, requirements) that are part of the intended functional scope.
[REMOTE_CODE_EXECUTION]: No remote code patterns were found. The skill relies on local Markdown prompts and YAML evaluation cases.
[OBFUSCATION]: No base64, hex-encoded strings, or hidden Unicode characters were detected in any of the analyzed files.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not use the dynamic context execution syntax (!command) to run shell commands at load time.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external data (test strategies), it contains clear boundary instructions to validate strategy bodies against supplied sources and to stop review if essential material is missing, reducing the risk of indirect injection.

test-strategy-review