The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Node.js scripts (container-runner.mjs and docker-release-smoke.mjs) that use node:child_process.spawn to manage Docker containers and execute test commands. The implementation uses shell: false and performs strict validation of configuration parameters to prevent command injection.
[EXTERNAL_DOWNLOADS]: The container runner installs toolchain components including pnpm and @deepseek-ai/dsh from the official npm registry. These are standard dependencies for the DeepSeek Harness environment.
[CREDENTIALS_UNSAFE]: The test runner includes a redactLogs function that uses regular expressions to identify and mask sensitive information such as Bearer tokens, API keys, and passwords in command-line arguments and process logs before they are written to reports.
[INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted log output from plugins. It mitigates indirect prompt injection risks by using a robust Markdown fencing mechanism that calculates the required number of backticks to safely encapsulate log content in reports.

plugin-test