The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating content retrieved from external sources (such as implementation plans and existing story details) directly into CLI arguments for the Salesforce sf tool. The use of single quotes within double-quoted strings in the sf data update record command creates a significant risk of command injection if the source content contains single quotes or other shell-sensitive characters.
[REMOTE_CODE_EXECUTION]: The skill relies on the execution of a local shell script, arc-implementation-plan-progress/scripts/init_progress_txt.sh, to initialize project artifacts. This represents a dependency on external executable code whose integrity and behavior are not managed within the skill itself.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from GitHub issue comments and Salesforce story details. A malicious actor could embed instructions in these external platforms to influence the agent's codebase analysis or task generation.
Ingestion points: Data is retrieved from GitHub issue bodies, comments, Salesforce agf__ADM_Work__c records, and PRD documents.
Boundary markers: None. The instructions lack explicit delimiters or warnings to treat ingested content as untrusted data.
Capability inventory: The agent has the ability to read and write files, execute CLI tools (gh, sf), and run local shell scripts.
Sanitization: None. The skill does not mention escaping, filtering, or validating external content before it is processed or used in shell commands.
[DATA_EXFILTRATION]: The skill establishes a functional pathway for internal project data, including source code analysis and architectural decisions, to be transmitted to external platforms like GitHub and Salesforce. While this aligns with the skill's purpose, it constitutes a deliberate data exposure surface.

arc-planning-work