The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from tickets, feedback, and session reports which could contain malicious instructions.
Ingestion points: Data enters the agent context from CawPlan tickets, knowledge-base documents, attachments, and user-submitted session reports as described in SKILL.md and references/UNTRUSTED_CONTENT.md.
Boundary markers: The skill provides a dedicated references/UNTRUSTED_CONTENT.md file that explicitly instructs the agent to treat external text as data, not instructions, and to ignore any commands found within.
Capability inventory: The skill utilizes the Bash tool to execute cawplan CLI subcommands for data retrieval and rollup reporting. It does not use generic code execution (eval/exec) on this data.
Sanitization: The skill mandates user confirmation for any write operations (e.g., creating or updating tickets) and prohibits the exfiltration of local credentials or environment variables.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to interact with the system and perform its primary functions.
Evidence: Multiple workflows in SKILL.md involve executing shell commands such as cawplan session, cawplan products, and cawplan users to fetch usage and team data.

cawplan-coding-insights