The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local files and environment variables to manage test credentials.
Sensitive file access: The installation script assets/install.sh reads .claude/settings.local.json, which is a configuration file that often contains sensitive MCP server credentials.
Environment file access: The orchestrator is instructed in SKILL.md (Phase 1) to read .env.qa. This file is used to store application secrets, such as QA_API_KEY, QA_AUTH_TOKEN, and test account passwords as seen in the template references/env-qa.md.
Credential propagation: Secrets retrieved from the environment are passed to sub-agents during Phase 3 of the orchestration process. This increases the risk of data leakage if the sub-agents are influenced by untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from external platforms, creating a vulnerability surface for indirect injection attacks.
Ingestion points: In SKILL.md (Phase 1), the agent fetches pull request metadata (titles, bodies) via mcp__github__get_pull_request and ticket descriptions via mcp__linear__get_issue.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when providing this external data to sub-agents (e.g., in Phase 3).
Capability inventory: The orchestrator has significant capabilities, including spawning new agents (via the Agent tool or mcp__forge__spawn_claude), executing shell commands (Bash), and creating GitHub issues (mcp__github__create_issue).
Sanitization: There is no evidence of validation or sanitization of the content fetched from GitHub or Linear before it is used to guide agent behavior.

qa-orchestrator