The Agent Skills Directory

[SAFE]: The skill implements rigorous security practices for testing environments. It explicitly requires environment classification (local-isolated vs unisolated) and mandates synthetic data by default. The instructions in references/adapters-and-safety.md and SKILL.md strictly forbid the use of real production secrets, credentials, or customer data, requiring a separate approval gate even for synthetic test credentials.
[SAFE]: Data exfiltration is mitigated through a mandatory evidence report contract that requires unconditional redaction of sensitive information, including tokens, private paths, and authorization headers. The skill also treats all external content (HTTP responses, logs, etc.) as untrusted data, explicitly instructing the agent never to treat them as instructions.
[SAFE]: Command execution is handled securely by requiring argument arrays and forbidding the use of shell=True or shell string interpolation for untrusted values, which prevents command injection vulnerabilities during test execution.
[SAFE]: The skill maintains a diagnosis-only posture, prohibiting automatic changes to product code without separate user approval, which prevents unintended modifications to the target repository.

python-blackbox-testing