qa-test-planner

ISSUES FOUND max severity CRITICALSkillSpector Do not install 57 registry skills.sh last scanned 2026-02-08 1 scan

22 findings (14 critical, 5 medium, 3 low), mainly command injection, policy violation, unauthorized tool use. Most recent scan 2026-02-08.

The qa-test-planner skill is a legitimate QA testing utility with LOW to MEDIUM security concerns. The skill provides test planning, test case generation, and bug reporting functionality through interactive Bash scripts. No critical security threats were identified - there is no data exfiltration, no prompt injection attempts, no credential theft, and no command injection vulnerabilities. The Bash scripts use safe practices with proper input validation and 'set -e' error handling. The primary concerns are: (1) missing 'allowed-tools' declaration which creates ambiguity about authorized agent tools, (2) missing license/compatibility metadata, and (3) incomplete file references. The skill reads only from its own internal package files (references/* directory), which is normal and expected behavior for self-contained skills. The Figma MCP integration mentioned in documentation appears to be an external dependency that users would configure separately, not a security risk within this skill package. Overall, this skill demonstrates good security practices and poses minimal risk to users.
Scanner's overall assessment (LLM analyzer)

Findings22

Critical14

High0

Medium5

Low3

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 57

Score57 / 100

Issues3

Categoriesanalysis-evasion Memory Poisoning

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Generate comprehensive test plans, manual test cases, regression test suites, and bug reports for QA engineers. Includes Figma MCP integration for design validation.

Package: 8 files, 73 KB
SKILL.md: 2761 words, 12+ sections
Code: Shell (2)

SKILL.md covers: QA Test Planner · Quick Start · Quick Reference · How It Works · Commands · Interactive Scripts · Natural Language · Core Deliverables · 1. Test Plans · 2. Manual Test Cases · 3. Regression Suites · 4. Figma Validation

Findings

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;32m

scripts/create_bug_report.sh:9

GREEN='\033[0;32m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;34m

scripts/create_bug_report.sh:10

BLUE='\033[0;34m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[1;33m

scripts/create_bug_report.sh:11

YELLOW='\033[1;33m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;31m

scripts/create_bug_report.sh:12

RED='\033[0;31m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;35m

scripts/create_bug_report.sh:13

MAGENTA='\033[0;35m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;36m

scripts/create_bug_report.sh:14

CYAN='\033[0;36m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0m

scripts/create_bug_report.sh:15

NC='\033[0m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;32m

scripts/generate_test_cases.sh:9

GREEN='\033[0;32m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;34m

scripts/generate_test_cases.sh:10

BLUE='\033[0;34m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[1;33m

scripts/generate_test_cases.sh:11

YELLOW='\033[1;33m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;31m

scripts/generate_test_cases.sh:12

RED='\033[0;31m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;35m

scripts/generate_test_cases.sh:13

MAGENTA='\033[0;35m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;36m

scripts/generate_test_cases.sh:14

CYAN='\033[0;36m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0m

scripts/generate_test_cases.sh:15

NC='\033[0m'

Remediation: Review and remove injection attack pattern

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: eval "$var_name=\"$

scripts/create_bug_report.sh:32

eval "$var_name=\"$input\""

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: eval "$

scripts/create_bug_report.sh:35

eval "$var_name=\"\""

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: eval "$var_name=\"$

scripts/generate_test_cases.sh:33

eval "$var_name=\"$input\""

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM User input used in command substitution - potential injection risk Command Injectionstatic

Pattern detected: eval "$

scripts/generate_test_cases.sh:36

eval "$var_name=\"\""

Remediation: Validate and sanitize all user inputs before using in commands

MEDIUM Missing allowed-tools Declaration Creates Ambiguity Unauthorized Tool Usellm

The skill manifest does not specify the 'allowed-tools' field, making it unclear which agent tools (Read, Write, Bash, Python, etc.) are authorized for use. While this field is optional per the spec, the skill includes Bash scripts that perform file operations and user input collection. Without explicit tool declarations, users cannot verify if the skill's behavior aligns with intended restrictions.

SKILL.md

YAML manifest shows: allowed-tools: Not specified. However, the skill includes executable Bash scripts (generate_test_cases.sh, create_bug_report.sh) that would require Bash tool access.

Remediation: Add 'allowed-tools: [Read, Bash]' to the YAML frontmatter to explicitly declare required agent tools and improve transparency.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing License and Compatibility Metadata Social Engineeringllm

The skill manifest lacks 'license' and 'compatibility' fields, which are important for users to understand usage rights and platform compatibility. While not a direct security threat, missing metadata reduces transparency and trust.

SKILL.md

YAML shows: license: Not specified, compatibility: Not specified

Remediation: Add license field (e.g., 'license: MIT') and compatibility field (e.g., 'compatibility: Claude.ai, Claude Code, API') to improve skill metadata completeness.

LOW Multiple Missing Referenced Files Data Exfiltrationllm

The skill references 15 files in its documentation, but 9 of these files are missing from the package (assets/test_case_templates.md, assets/figma_validation.md, right.py, Figma.py, templates/*, mobile.py, assets/regression_testing.md). While the core functionality appears intact with the existing reference files, missing files could indicate incomplete packaging or create confusion for users expecting these resources.

Referenced but missing: assets/test_case_templates.md, assets/figma_validation.md, right.py, Figma.py, templates/regression_testing.md, templates/figma_validation.md, templates/test_case_templates.md, templates/bug_report_templates.md, mobile.py, assets/regression_testing.md

Remediation: Either include all referenced files in the package or remove references to non-existent files from the documentation. Verify that right.py, Figma.py, and mobile.py are not required for core functionality.

What is in the package

File	Kind	Size
`README.md`	doc	11 KB
`SKILL.md`	doc	18 KB
`references/bug_report_templates.md`	doc	8.4 KB
`references/figma_validation.md`	doc	6.9 KB
`references/regression_testing.md`	doc	7.1 KB
`references/test_case_templates.md`	doc	9.0 KB
`scripts/create_bug_report.sh`	script	5.8 KB
`scripts/generate_test_cases.sh`	script	6.5 KB

Environment variables referenced

BUG_ID FIGMA_URL OUTPUT_DIR TC_ID WHY_IMPORTANT

Package contents recorded 2026-10-22 at commit b00cf8491de1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/softaworks/agent-toolkit
Raw scan result: qa-test-planner-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/skills-sh-qa-test-planner.svg)
Request a re-scan