The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses docker exec to run tests, incorporating dynamic variables such as {workdir}, {test_container}, and {optional_filter} directly into shell command strings. Evidence found in SKILL.md: timeout 120 docker exec -w {workdir} {test_container} vendor/bin/phpunit --testdox --stop-on-failure --stop-on-error {optional_filter}. Risk: If an attacker can influence the values of these placeholders (e.g., through a malicious phpunit.xml, composer.json, or a crafted test task description containing shell metacharacters), they may be able to execute arbitrary commands within the Docker container context.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the repository to inform its actions. Ingestion points: Reads application source code (Services, Controllers), phpunit.xml, and composer.json as described in SKILL.md (Phase 1). Boundary markers: None identified; the skill does not use delimiters or instructions to ignore embedded commands within the read data. Capability inventory: Performs filesystem writes and executes commands via docker exec. Sanitization: None identified; there is no mention of escaping or validating the content read from files before it is used to generate tests or construct shell commands. Risk: Maliciously crafted content within the project files could manipulate the agent's logic, leading to the generation of unsafe code or the execution of unintended commands.

create-backend-tests