The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple Python wrapper scripts (e.g., scripts/convert_to_csv.py, scripts/parse_excel.py) that utilize subprocess.call() to execute a core conversion script (convert_formats.py or parse_formats.py). These executions are localized to the skill's own file structure and are used for functional task chaining rather than arbitrary command execution.
[DATA_EXPOSURE]: The skill is designed to ingest and process project context and external files (Word, Excel, Mindmaps) provided by the user. While this creates a surface for Indirect Prompt Injection (Category 8), the behavior is consistent with the skill's primary purpose of generating QA strategies based on project documentation. No evidence of data exfiltration or unauthorized access was found.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns, such as piping network downloads to a shell, were detected. All scripts executed are local and part of the skill package.

test-strategy