testland/bug-report-template
Use for any question or task about bug reports, including what makes a good one, turning an informal complaint or a CI failure (JUnit XML, Allure, pytest or Playwright output) into a report, and reports closed as cannot reproduce. Fills summary, environment, steps, expected vs actual and severity rationale, then checks each field is usable.
87%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required CI-failure workflow searches the team's issue tracker (Jira, GitHub Issues, Linear, or Azure DevOps) for matching open bugs before filing, and it reads those titles and bodies, which outsiders can file into, so this is medium exposure.
Where we found it
atlassian.net
domain · 2 sites
The plugin instructs the agent to search the tracker (including Jira Cloud at atlassian.net) for open bugs with matching titles before filing, reading issue titles and bodies that outsiders can file into.
SKILL.md:329
SKILL.md:330
github.com
domain · 2 sites
The plugin instructs the agent to search the tracker (including GitHub Issues at github.com) for open bugs with matching titles before filing, reading issue titles and bodies that outsiders can file into.
SKILL.md:329
SKILL.md:330
linear.app
domain · 2 sites
The plugin instructs the agent to search the tracker (including Linear at linear.app) for open bugs with matching titles before filing, reading issue titles and bodies that outsiders can file into.
SKILL.md:329
SKILL.md:330
dev.azure.com
domain · 2 sites
The plugin instructs the agent to search the tracker (including Azure DevOps at dev.azure.com) for open bugs with matching titles before filing, reading issue titles and bodies that outsiders can file into.
SKILL.md:329
SKILL.md:330
- Audited
- Security analysis