The Agent Skills Directory

[DYNAMIC_EXECUTION]: The main SKILL.md file demonstrates the use of the eval() function within a test_eval example to process parametrized input strings. The use of eval() represents a significant security risk as it allows for the execution of arbitrary Python code.
[COMMAND_EXECUTION]: The references/plugin-misc.md file documents the pytest-bg-process plugin, which allows for the execution of arbitrary background shell commands (e.g., redis-server) defined via the background-cmd configuration or environment variables.
[CREDENTIALS_UNSAFE]: The references/plugin-postgresql.md reference contains code examples with hardcoded placeholder credentials, such as password="secret". While common in documentation, these present a risk of credential exposure if copied verbatim into production or shared environments.
[EXTERNAL_DOWNLOADS]: The references/plugin-misc.md file documents pytest-venv, which provides an API for programmatically installing external packages from remote repositories during test execution via venv.install().
[INDIRECT_PROMPT_INJECTION]: references/advanced-patterns.md provides implementation patterns for custom test collectors that process external data files (e.g., YAML) into test items.
Ingestion points: pytest_collect_file reads from the local file system using self.path.open().
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: The skill provides instructions for substantial system interaction, including background process management, browser automation via Playwright, and access to Google Cloud Secret Manager.
Sanitization: While yaml.safe_load() is used to prevent arbitrary object instantiation during parsing, the content of the data is directly used to generate test metadata and drive test logic without further sanitization.

pytest