The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded credentials found in multiple files.
Evidence: The password 123456789MikoPBX#1 is used in authentication fixtures within SKILL.md, templates/test-template.py, and reference/pytest-patterns.md.
Context: This appears to be a default development password for the MikoPBX system, but hardcoding it in templates poses a risk if used in production-like environments.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform several sensitive operations.
Evidence: It executes find and grep commands to locate DataStructure.php files on the local filesystem (e.g., path /Users/nb/PhpstormProjects/mikopbx/...).
Evidence: It uses docker exec to modify environment variables within a running container (e.g., setting SCHEMA_VALIDATION_STRICT=1).
[PROMPT_INJECTION]: The skill identifies an indirect prompt injection surface.
Ingestion points: The skill reads configuration and parameter definitions from DataStructure.php files via Bash tools.
Boundary markers: No explicit boundary markers or "ignore instructions" warnings are used when processing the PHP file content.
Capability inventory: The skill generates executable Python scripts that use the requests library and are intended to be run via pytest.
Sanitization: There is no evidence of sanitization or validation of the content extracted from the PHP files before it is interpolated into the generated Python code.
[COMMAND_EXECUTION]: The skill generates Python script files (.py) at runtime based on templates and external data, which is a form of dynamic code generation.

api-test-generator