The Agent Skills Directory

[SAFE]: The skill is primarily educational and utility-based, providing templates and scripts for software testing and debugging.
[INDIRECT_PROMPT_INJECTION]: The skill contains a script scripts/analyze_coverage.py which ingests external JSON data from coverage reports.
Ingestion points: parse_coverage_json reads from a user-specified or default path (e.g., coverage/coverage-final.json).
Boundary markers: None identified for the JSON input.
Capability inventory: The script performs read-only operations and prints analysis to the console; it does not execute code from the JSON or perform network/write operations.
Sanitization: Standard json.load() is used. The risk is negligible as the data is used for calculation and reporting only.
[DATA_EXPOSURE]: The reference file references/bug_analysis.md mentions sensitive patterns like /etc/passwd and ${process.env.SECRET}, but these are explicitly presented as examples for developers to write sanitization tests against, not as attempts to access the actual system files.
[COMMAND_EXECUTION]: The Python scripts scripts/analyze_coverage.py and scripts/find_untested_code.py use standard libraries (os, pathlib, sys) to navigate the local filesystem for project files. They do not invoke shell commands with untrusted input or perform dangerous system modifications.

test-specialist