The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the external TAPD platform that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Data is retrieved from the TAPD API via subcommands in scripts/tapd.py such as get_stories_or_tasks, get_bug, get_comments, and get_wiki.
Boundary markers: The instructions in SKILL.md and the output of the scripts do not include delimiters or specific warnings to the agent to disregard instructions embedded within the retrieved data.
Capability inventory: The skill provides extensive write capabilities, including creating and updating stories, tasks, bugs, wiki pages, and iterations, as well as sending messages to Enterprise WeChat webhooks.
Sanitization: There is no evidence of sanitization, filtering, or instruction-scrubbing for the content retrieved from TAPD before it is passed to the agent's context.
[COMMAND_EXECUTION]: The skill is designed for the agent to execute local Python scripts (scripts/tapd.py) via the shell to interact with the TAPD API. While this is the intended functionality, it grants the agent the ability to perform a wide range of administrative actions on the TAPD platform based on the user's provided credentials.
[DATA_EXFILTRATION]: The send_qiwei_message command in scripts/tapd.py (calling TAPDClient.send_message in scripts/tapd_client.py) sends data to an external URL defined by the BOT_URL environment variable. While functionally necessary for Enterprise WeChat integration, this mechanism could be misused to transmit sensitive project information to an unauthorized endpoint if the environment variable is misconfigured.

tapd