The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of user-defined commands to start development runtimes and perform implementation tasks. This is implemented using child_process.spawn with shell: false to prevent shell injection. Furthermore, the system includes a process-host helper that verifies ownership of processes using unique start tokens and OS-level metadata checks.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent vulnerability surface for indirect prompt injection as it ingests and processes untrusted data from application logs, source code, and web content during testing.
Ingestion points: The framework reads application stdout/stderr logs (scripts/lib/runtime.mjs), project source files during attestation (scripts/lib/source.mjs), and captures application evidence (references/scenarios-and-evidence.md).
Boundary markers: The protocol utilizes structured YAML records and role-specific markdown handoffs to isolate contexts, though it relies on the AI agent to respect these boundaries.
Capability inventory: The skill can execute arbitrary subprocesses (scripts/lib/process-host.mjs), perform Git operations, and interact with the GitHub API via the gh CLI (scripts/lib/delivery.mjs).
Sanitization: It employs a shellQuote utility for instruction rendering and avoids shell interpolation for its internal process management logic.

run-agentic-tests