The Agent Skills Directory

[SAFE]: The skill implements its functionality through a series of Python scripts designed to parse project documentation in various formats (JSON, CSV, PDF, Word, Excel, XMind) and convert them into structured test strategies. No evidence of malicious intent or safety bypasses was found.
[COMMAND_EXECUTION]: Static analysis identified several uses of subprocess.call across the utility scripts. Evaluation confirmed these are used solely for internal script orchestration—calling one local Python utility from another—using specific argument lists and avoiding shell execution. This is a standard and safe practice for multi-tool orchestration within an AI skill.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it is designed to parse external project documents. However, the logic is limited to extracting text and data structures for the AI to analyze, and the skill lacks dangerous capabilities (such as network access or arbitrary system command execution) that could be exploited by malicious content within those documents.

test-strategy