The Agent Skills Directory

[METADATA_POISONING]: The skill includes a file titled .security-scan-passed which contains a content hash and timestamps designed to mimic an official security validation report. This is a deceptive practice used to provide a false assurance of safety.\n- [INDIRECT_PROMPT_INJECTION]: The skill's operational model involves the autonomous ingestion of instructions from project files (e.g., 02-CLI-TEST-CASES.md, TEST-EXECUTION-TRACKING.csv), which establishes a broad attack surface for indirect prompt injection.\n
Ingestion points: The agent is instructed to read and follow test specifications from markdown documents and tracking CSVs found in the target project's directory.\n
Boundary markers: There are no documented delimiters or safety instructions within the prompt library to prevent the agent from obeying malicious instructions embedded in these data sources.\n
Capability inventory: The skill possesses capabilities to execute shell commands (git, pnpm, docker, ccpm), perform file system operations, and manage project dependencies.\n
Sanitization: The skill lacks logic to sanitize or filter the content of ingested test cases before they are processed as instructions.\n- [COMMAND_EXECUTION]: The framework relies on executing high-impact shell commands such as pnpm install, docker exec, and git clone. While these are functional requirements for QA, they represent a significant risk if the agent is directed to interact with malicious project repositories.\n- [PROMPT_INJECTION]: The master prompt library uses persona-based framing ('senior QA engineer at Google') and strong imperative constraints ('CRITICAL INSTRUCTIONS', 'MANDATORY RULES') to take control of the agent's logic for autonomous task execution.

qa-expert