The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external content such as ticket descriptions, comments, and attachments which may contain malicious instructions. This risk is addressed in the references/UNTRUSTED_CONTENT.md file, which establishes rules for the agent to treat all such data as non-authoritative, use boundary markers (quoting) when displaying it, and ignore any embedded commands or requests to bypass safety protocols.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the cawplan CLI. The instructions provide specific, structured commands for searching, listing, downloading, and uploading attachments. The execution is bounded by the CLI's own logic and the restrictive instructions provided in the skill.
[DATA_EXFILTRATION]: While the skill can upload local files to a remote ticket system, it contains hardcoded protections against the exfiltration of sensitive data. It explicitly blocks access to credential directories and files such as ~/.ssh, ~/.aws, and .env. Additionally, it requires a --dry-run check and explicit user approval before any file is uploaded.
[EXTERNAL_DOWNLOADS]: The skill supports downloading attachments from CawPlan's private CDN. Security is maintained by instructing the agent to only read these files for inspection and strictly forbidding the execution, installation, or sourcing of any downloaded content.

cawplan-ticket-attachments