The Agent Skills Directory

[DYNAMIC_EXECUTION]: The SKILL.md file contains a 'Run History' section that instructs the agent to execute a node -e shell command. This template requires the agent to dynamically construct a JavaScript snippet by interpolating variables such as STATEMENTS, BRANCHES, and GAPS directly into the code string. This practice of generating and executing code from potentially untrusted variables facilitates command injection or arbitrary code execution if those variables contain malicious payloads from manipulated coverage reports.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external coverage reports (Istanbul, c8, lcov). Since these files are generated outside the trusted environment, they represent an attack surface where malicious content could be embedded to influence the agent's logic or exploit the dynamic execution vulnerability in the history logging step.\n
Ingestion points: External test coverage reports (Istanbul, c8, lcov) and source files specified in the aqe command arguments.\n
Boundary markers: There are no explicit delimiters or instructions defining how to distinguish trusted agent commands from untrusted report content.\n
Capability inventory: The skill utilizes shell command execution via the aqe CLI and dynamic JavaScript execution via node -e.\n
Sanitization: The instructions do not define any validation, filtering, or escaping protocols for data extracted from external reports before it is processed or interpolated into scripts.\n- [COMMAND_EXECUTION]: The skill's workflow relies on the execution of shell commands, including a custom aqe utility and the node runtime. While these tools are central to the skill's stated purpose of coverage analysis, their use in combination with unsanitized external data provides the primitive necessary for the higher-severity risks identified.

qe-coverage-analysis