testland/bug-bash-facilitator
Builds a structured bug-bash session - pre-bash kit (charter, test-data prep, environment setup, sign-up sheet), in-bash structure (role rotation across cohorts, shared backlog board, real-time triage), scoring rubric (severity weighting, novelty bonus), and a post-bash same-day wrap-up authored by the facilitator (not a standalone debrief: for post-session writeups without a live bash, use the PROOF debrief in exploratory-testing). Use when a team needs a coordinated multi-tester sweep before a release or after a major change - converts an ad-hoc "everyone test for an hour" into a recorded, comparable session with deliverables.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md describes a shared backlog board (spreadsheet/Notion/GitHub issues view) with a “Triage” column and real-time updates, meaning outsider-authored test findings/comments could be ingested for triage without selecting a specific pre-chosen item.
Where we found it
shared backlog board (spreadsheet / Notion table / GitHub issues view)
content-type · 4 sites
The plugin instructs the agent (as facilitator) to read and triage entries on a shared board where multiple testers write bug reports with free-text titles and repro steps, which constitutes ingestion of multi-author content.
SKILL.md
112
A shared spreadsheet / Notion table / GitHub issues view that everyone can see live during the bash
SKILL.md
110
## Step 3 - Shared backlog board
SKILL.md
122
The **Triage** column is filled in real-time by a roving facilitator who decides
SKILL.md
217
When done, log findings to the same shared board with `async` tag.
- Audited
- Security analysis