The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from test runner output and project-specific configuration files which are then processed by an LLM to determine remediation actions. An attacker could potentially embed malicious instructions or fake error signatures in test logs to manipulate the agent's decision-making process.
Ingestion points: The skill captures stdout and stderr from test runs in Phase 2 and reads project-level fixer definitions from .claude/test-deep/fixers.md.
Boundary markers: The skill uses structured JSON tags and prompt templates for the analyst LLM but lacks robust logical delimiters to separate untrusted test data from its own instructions.
Capability inventory: The skill has access to Bash, Agent, and Write tools to execute fixes, dispatch subagents, and store artifacts.
Sanitization: The skill implements a mandatory secret redaction pipeline per @rules/logging.md to strip API keys, private keys, and tokens before the LLM processes any output.
[DYNAMIC_EXECUTION]: The skill dynamically loads and executes instructions from a project-local fixer catalog. While these are mediated by a safety gate, it allows for runtime interpretation of logic provided by the project being tested.
Mechanism: The action field in the host extension schema provides execution instructions that the agent interprets at runtime.
Mitigation: A safety gate requires user approval via the AskUserQuestion tool for any actions classified with side-effects or originating from unknown fixers.
[EXTERNAL_DOWNLOADS]: The skill performs package installations via npm install as part of its core core_deps fixer. This is a standard development operation targeting a well-known service and is gated by user confirmation.

test-deep