The Agent Skills Directory

[COMMAND_EXECUTION]: The skill incorporates shell commands within its Verification section to automate the validation of its output. It uses grep, sort, and comm to compare numerical data between the input and output files and to check for banned phrases.
Evidence: grep -oE '[0-9]+(\.[0-9]+)?%?|P[0-3]|[0-9]{3}' input.md | sort -u > /tmp/in.txt in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection as it ingests and processes untrusted QA report drafts provided by users.
Ingestion points: Untrusted content is read from input.md as part of the verification workflow.
Boundary markers: The skill does not implement explicit delimiters or instruction-gating when passing the contents of input.md to shell utilities.
Capability inventory: The agent has access to shell execution for text processing utilities (grep, sort, comm) as defined in SKILL.md.
Sanitization: There is no evidence of sanitization or flag-injection prevention (e.g., using --) when the content of input.md is processed by shell commands.

qa-report-humanizer