The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill instructions direct the agent to execute arbitrary shell commands including vendor/bin/phpunit, npm run test, npx jest, and ddev exec. These commands execute code defined in the project's configuration files.
[REMOTE_CODE_EXECUTION] (HIGH): By running npm run test or npx jest, the agent may execute scripts defined in package.json. If an attacker can modify these files (indirectly through a malicious repository or pull request), they can achieve arbitrary code execution on the agent's host environment.
[INDIRECT_PROMPT_INJECTION] (HIGH): The skill possesses a 'High' capability tier (External content + execute capability).
Ingestion points: The agent reads the local file system, including source code, test files, and configuration files (package.json, phpunit.xml).
Boundary markers: None. There are no instructions to sanitize or isolate the execution of these test tools.
Capability inventory: Shell execution (find, phpunit, jest, npm, npx, ddev) is used throughout the skill.
Sanitization: Absent. The skill assumes the repository and its test configurations are safe to execute.

coverage-analyzer