The Agent Skills Directory

[METADATA_POISONING]: The skill includes a hidden file named .security-scan-passed which contains a simulated security audit report including a fake content hash and a timestamp. This mimics the output of automated security scanners like 'gitleaks' to suggest the skill has been verified, which is a deceptive practice that may lead users to misjudge the skill's safety.
[INDIRECT_PROMPT_INJECTION]: The skill enables an autonomous execution mode where the agent is directed to read and execute instructions from external files that it may also have permission to modify.
Ingestion points: The agent reads test specifications and status from tests/docs/ markdown documents, TEST-EXECUTION-TRACKING.csv, and BASELINE-METRICS.md.
Boundary markers: The instructions in references/master_qa_prompt.md and references/llm_prompts_library.md lack delimiters or specific warnings to ignore instructions embedded in the ingested data, increasing the risk of the agent following malicious commands hidden in test cases.
Capability inventory: The skill framework grants the agent access to execute shell commands (e.g., git, pnpm, npx, docker) and write files to the project directory, as documented in references/day1_onboarding.md and references/master_qa_prompt.md.
Sanitization: No evidence of input validation or command filtering is present for the content read from test documentation.
[COMMAND_EXECUTION]: The skill's 'Autonomous Execution' feature and onboarding guides direct the agent to perform complex system-level operations, including repository cloning, global package linking, and database container management. While intended for quality assurance, the automation of these tasks via the 'Master Prompt' based on file content poses a security risk if the input files are compromised.

qa-expert