The Agent Skills Directory

[SAFE]: The skill consists entirely of Markdown instructions and templates. No executable code (Python, JavaScript, shell scripts) is included in the package. It functions as a prompt-based guide for an AI agent to structure project management data.
[COMMAND_EXECUTION]: Analysis of the skill-report.json file reveals historical flags for 'Ruby/shell backtick execution' in SKILL.md. These were investigated and confirmed as false positives triggered by standard Markdown code fences (e.g., ```markdown) used to demonstrate plan templates. No actual shell commands are present.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided project data (scope, timeline, priorities) to generate release plans. While this is an ingestion surface for untrusted data, the skill lacks the dangerous capabilities (such as automated shell execution or file-system writing) necessary to turn this into a high-risk vulnerability. The agent's role is restricted to text generation based on the provided templates.
[DATA_EXFILTRATION]: There are no network operations, API calls, or commands that access sensitive user directories (e.g., .ssh, .aws) or environment variables. The skill does not transmit data to external domains.

agile-planning