The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The scripts/test_runner.py script executes commands using subprocess.run based on findings in the target project's configuration files.
Evidence: In scripts/test_runner.py, the run_tests function executes commands like npm test, npx vitest, or pytest which are derived from the project environment.
REMOTE_CODE_EXECUTION (HIGH): The skill effectively executes arbitrary code contained within a target project's test suite or script definitions.
Evidence: The detect_test_framework function in scripts/test_runner.py parses package.json and automatically selects execution paths that run project-specific code.
INDIRECT_PROMPT_INJECTION (HIGH): The skill is highly susceptible to indirect injection because it processes untrusted data (project files) and has the capability to execute side-effect-heavy commands.
Ingestion points: package.json, pyproject.toml, and requirements.txt in the target project directory.
Boundary markers: None. The script does not use delimiters or warnings to separate trusted instructions from untrusted project content.
Capability inventory: Arbitrary command execution via subprocess.run for Node.js and Python ecosystems.
Sanitization: None. The script trusts the values found in package.json scripts and dependency lists.

testing-patterns