The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on npx claude-flow@alpha for its core functionality, which involves downloading and executing code from the public npm registry at runtime. The package source is not within the defined trusted vendor list.
[COMMAND_EXECUTION]: The skill instructions heavily utilize shell command execution, including npx, git, curl, and jq for verification tasks, rollback operations, and CI/CD integration.
[DATA_EXFILTRATION]: The skill provides explicit examples of using curl to transmit verification metrics and truth scores to external endpoints such as pushgateway.example.com and metrics.example.com. While intended for monitoring, this established pattern could be leveraged to exfiltrate sensitive codebase metrics to unauthorized locations.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to process and verify 'agent outputs', 'tasks', and codebase files (e.g., src/app.js).
Boundary markers: The provided instructions do not specify any boundary markers or delimiters to separate verification logic from the content being analyzed.
Capability inventory: The skill utilizes subprocess calls to npx, git, and curl across its various quality assurance functions.
Sanitization: No evidence of sanitization or escaping of the ingested agent outputs is mentioned before they are processed by the verification engine.

qe-verification-quality