The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content such as tickets, screenshots, and user feedback, which represents a potential surface for indirect prompt injection attacks.
Ingestion points: External data enters the agent context through cawplan tickets search results and multimodal image analysis (referenced in references/workflow-step1-material.md).
Boundary markers: The skill proactively mitigates this risk by including references/UNTRUSTED_CONTENT.md, which instructs the agent to treat all external inputs as data rather than instructions and to ignore any embedded commands.
Capability inventory: The skill possesses the capability to execute shell commands and perform write operations to the CawPlan database using the cawplan CLI (as described in references/workflow-archive.md).
Sanitization: Security is enforced through mandatory user confirmation checkpoints for all state-changing operations, ensuring that the agent does not act autonomously on potentially malicious data.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute commands via the cawplan CLI. These commands are restricted to legitimate administrative tasks such as ticket lookups, product overview retrieval, and requirement archiving. The use of the CLI is consistent with the skill's stated purpose and the author's vendor context.
[DATA_EXFILTRATION]: Although the skill handles sensitive organizational data, it incorporates strict guidelines in references/UNTRUSTED_CONTENT.md that explicitly forbid the exfiltration of credentials, API tokens, or secrets to any external entity or document.

cawplan-requirement-analyze