The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze external data such as software test execution outputs, LLM evaluation transcripts, and third-party source code. This functionality creates an attack surface for indirect prompt injection, where malicious instructions hidden in the data could compromise the agent's behavior.
Ingestion points: The skill processes code, test failure traces, and LLM logs across various suites (e.g., references/ai-writes-tests.md, references/llm-eval.md).
Boundary markers: While the skill advocates for identifying test boundaries, it lacks specific instructions for the agent to use robust delimiters or "ignore" instructions for untrusted data.
Capability inventory: The agent is given capabilities to execute shell commands to run tests and perform file writes to modify source code and test suites.
Sanitization: No explicit sanitization or filtering logic is provided for external inputs before processing.
[METADATA_POISONING]: The reference documentation and consolidated bibliography contain several hallucinated citations and future-dated references (e.g., to research papers dated 2026, such as arxiv.org/html/2603.13724). These misleading entries could confuse the agent or mislead reviewers regarding the established evidence for specific testing patterns.
[COMMAND_EXECUTION]: The skill involves the execution of local command-line tools for testing (e.g., pytest, npm test, pact) and project delivery gates. This is consistent with the primary purpose of a testing-focused skill but represents a significant capability that should be monitored.
[EXTERNAL_DOWNLOADS]: The documentation references and recommends various well-known testing frameworks and libraries. These downloads are associated with official documentation and standard package registries, and are generally safe as they target trusted or well-known organizations.

testing-boss