The Agent Skills Directory

[SAFE]: A thorough analysis of the skill's instructions, code snippets, and rules found no evidence of malicious patterns. The content is strictly instructional and scoping is handled correctly through standard Markdown and YAML conventions.
[COMMAND_EXECUTION]: The skill provides numerous example shell commands for managing dependencies (e.g., npm install, pip install) and executing test runners (e.g., playwright, cypress, k6, pytest). These are documented as standard development workflows and do not involve silent or forced execution.
[EXTERNAL_DOWNLOADS]: Includes instructions to download well-known development tools, such as Toxiproxy from Shopify's official GitHub releases. Per security guidelines, downloads from established and well-known services are considered safe when they align with the skill's primary purpose.
[CREDENTIALS_UNSAFE]: The skill consistently recommends best practices for credential management, using environment variable lookups (e.g., process.env.PACT_BROKER_TOKEN, {{$dotenv AUTH_TOKEN}}) rather than hardcoding secrets in code or configuration files.
[INDIRECT_PROMPT_INJECTION]: While the skill involves processing and generating code based on user testing requirements, it does not expose sensitive attack surfaces or implement logic that would facilitate the execution of untrusted external instructions.

testing