The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches and displays user-generated content (ticket descriptions and titles) from the CawPlan platform, creating a vulnerability to instructions embedded in that data.
Ingestion points: The skill uses cawplan tickets search in SKILL.md (Step 5) to retrieve ticket details, including the description field which is used as the canonical title.
Boundary markers: The instructions lack explicit boundary markers or delimiters when interpolating these descriptions into the output, and they do not provide warnings to the agent to ignore instructions within the retrieved content.
Capability inventory: The skill has access to the Bash tool to execute cawplan CLI commands, which could be abused if an injection succeeds in redirecting the agent's behavior.
Sanitization: The instructions explicitly mandate that the agent 'display it verbatim' without shortening or normalization, although optional Markdown escaping is mentioned.
[COMMAND_EXECUTION]: The skill's primary functionality involves executing multiple shell commands via the Bash tool. While these commands (cawplan products list, cawplan tickets search, etc.) are restricted to a specific CLI, the process involves interpolating user-supplied arguments (like product names and version IDs) directly into shell strings. Although the skill includes instructions to use 'unquoted tokens' to mitigate execution issues, this pattern remains a potential vector for command injection if input validation is bypassed.

cawplan-plan-track