The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, specifically TestRail test results and existing CawPlan tickets, which introduces a potential surface for indirect prompt injection.
Ingestion points: Data is retrieved from TestRail via cawplan qa-insights testrail execution failures and from CawPlan ticket fields as described in SKILL.md and references/execution.md.
Boundary markers: The skill includes a dedicated references/UNTRUSTED_CONTENT.md file that provides clear instructions to treat external data as untrusted and to ignore any embedded commands or instructions.
Capability inventory: The skill uses the Bash tool to execute cawplan CLI commands, which include capabilities for both reading system state and creating/linking tickets (write operations).
Sanitization: Multiple layers of defense are implemented: a mandatory two-step confirmation gate for writes (Step 2 decision gate and Step 4/5 submission gate with --confirm), and a requirement to use --body-file for complex JSON payloads containing user-controlled text, which effectively mitigates command injection risks.
[SAFE]: No malicious patterns, unauthorized data exfiltration, or obfuscation techniques were detected. The skill's instructions strictly adhere to a workflow that prioritizes user oversight and data integrity.

cawplan-defect-ticket