The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow relies on ingesting data from external sources, specifically Jira/TMS tickets, to plan and generate test code. Malicious actors could potentially embed prompt injection triggers within Jira story descriptions or comments to manipulate the agent's output or execution.
Ingestion points: The agent reads synced markdown files containing Jira content (story.md, acceptance-criteria.md, comments.md, acceptance-test-plan.md) during Phase 1 (Plan) and Phase 2 (Code).
Boundary markers: There are no explicit instructions for the agent to sanitize or treat this specific external content as potentially untrusted during processing.
Capability inventory: The agent has the capability to write files, execute build commands (e.g., bun run test), and perform network requests to sync data.
Sanitization: No automatic sanitization of incoming Jira text is documented.
[DYNAMIC_EXECUTION]: The skill generates TypeScript code for Page and API component classes at runtime, based on provided templates and the content of external tickets. This code is immediately executed using the bun test runner to verify functionality. While this is the intended purpose, it represents a dynamic code execution surface.
The skill uses predefined templates (KATA layers) to guide the agent in producing consistent, valid code.
Verification steps including type-checking and linting are integrated into the workflow to ensure code quality.
[COMMAND_EXECUTION]: The skill uses several CLI tools, such as bun, playwright, git, and internal scripts for OpenAPI syncing and Jira integration. These commands are executed to automate the testing lifecycle.
[DATA_EXFILTRATION]: The skill accesses and processes sensitive information, including environment variables like ATLASSIAN_API_TOKEN and XRAY_CLIENT_SECRET. It transmits test results and coverage data back to external issue trackers (Jira and Xray Cloud).
Network operations target well-known and trusted platforms (Atlassian Jira, Xray Cloud).
The skill follows security best practices by requiring these credentials to be stored in .env files rather than being hardcoded.
[EXTERNAL_DOWNLOADS]: The skill downloads project artifacts, including OpenAPI schemas and Jira ticket data, during its synchronization phases. These downloads target official project endpoints and trusted issue-tracking services.

test-automation