The Agent Skills Directory

[SAFE]: The skill uses a structured approach for software testing, incorporating manual approval steps (gates) for test cases and reports. This design minimizes the risk of autonomous agents executing unreviewed actions.
[COMMAND_EXECUTION]: The skill executes local scripts such as scripts/guard_exec.py and standard tools like playwright and mysql. These operations are scoped to the project environment and the author's specified testing workflow.
[DATA_EXPOSURE]: Sensitive credentials (accounts) and local paths (repositories) are stored in .local.md files which are explicitly mandated to be included in .gitignore, following security best practices for local secret management.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests external data (requirements, PRDs), it implements boundary markers (checklists, templates) and requires manual human review of the generated test cases before execution, significantly mitigating injection risks.
[REMOTE_CODE_EXECUTION]: No patterns of downloading and piping remote scripts to shells (e.g., curl|bash) were found. Dependencies are managed locally through standard package managers like npm/playwright.

sdlc-test