The Agent Skills Directory

[COMMAND_EXECUTION]: The interactive bash scripts scripts/generate_test_cases.sh and scripts/create_bug_report.sh contain a command injection vulnerability in the prompt_input function.
Evidence: Both scripts use the pattern eval "$var_name=\"$input\"" to assign user input to variables. Because eval processes the string as a command, an attacker or malicious user input containing shell metacharacters (e.g., $(command), `command`, or ; command) will result in the execution of arbitrary commands in the user's shell environment.
Remediation: Replace the eval logic with a direct variable assignment or use read -r varname directly into the target variable without using eval to perform dynamic name resolution.

qa-test-planner