The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection in SKILL.md because it directly interpolates the user-provided ${URL} variable into shell commands executed via the Bash tool, specifically in the automated fetch cascade (node ./scripts/fetch-content.js "${URL}" ...) and the fallback Playwright setup scripts. This allows an attacker to execute arbitrary shell commands by providing a crafted URL containing shell metacharacters.
[PROMPT_INJECTION]: The skill implements an indirect prompt injection surface in SKILL.md by fetching content from external URLs and passing it into the prompts of multiple sub-agents (e.g., qe-quality-criteria-recommender, qe-risk-assessor) which possess sensitive capabilities such as file writing and tool execution.
Ingestion points: External web content is fetched via the fetch-content.js script in Phase URL-1 of SKILL.md based on a user-provided URL.
Boundary markers: Minimal delimiters (e.g., === EPIC CONTENT START ===) are used in some sub-agent prompts, but are entirely absent in others, such as the regex-based flag detection logic in Phase URL-2.
Capability inventory: All spawned agents have access to the Task, Bash, Write, and Read tools as defined in the swarm orchestration logic in SKILL.md.
Sanitization: No sanitization, escaping, or validation of the fetched external content is performed before it is interpolated into agent prompts.
[EXTERNAL_DOWNLOADS]: The skill performs dynamic installation of unverified Node.js packages (playwright-extra, puppeteer-extra-plugin-stealth, playwright) and executes external CLI tools via npx (aqe, @claude-flow/cli) from remote registries at runtime in SKILL.md.

qcsd-ideation-swarm