The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill translates identified logic bugs into executable test scripts (e.g., qc-off-by-one-pagination) and runs them using project-specific test runners like pytest, vitest, or jest. While this is the skill's primary purpose, the generation of code based on external input (the source code being reviewed) presents a potential vector for arbitrary code execution if the input code is crafted to manipulate the test generation logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of code files and git diffs to perform its analysis. This creates an attack surface where malicious instructions hidden in comments or strings within the reviewed code could influence the agent's behavior, potentially leading to incorrect security verdicts or manipulated test outputs.
[COMMAND_EXECUTION]: The skill performs shell-level operations, including executing git diff to determine its review scope and invoking local Python scripts (harness/scripts/qc-regression.py and harness/scripts/grounding-check.py) to manage test execution and verdict validation.

qc-code