The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on the taskctl CLI to perform operations such as issue get, issue create, issue move, comment add, and project readme get. These commands are used to interact with both local loopback services (defaulting to http://127.0.0.1:47823) and remote cloud services.
[INDIRECT_PROMPT_INJECTION]: The skill reads external data including issue descriptions, comments, and project READMEs using taskctl issue get, taskctl comment list, and taskctl project readme get. This content, which can be controlled by external actors, is processed by the agent to guide its workflow. The skill lacks explicit boundary markers or sanitization procedures for this ingested content, creating a surface for potential prompt injection attacks via the taskboard data.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to download attachments from the taskboard service to a local file path using the command taskctl attachment download ATTACHMENT_ID --output PATH. This allows the agent to fetch external data and write it to the local filesystem.
[DATA_EXFILTRATION]: The skill supports uploading local files to a remote or local taskboard service via taskctl attachment upload. It also includes a cloud login feature that allows configuring an arbitrary HTTPS_ORIGIN, which could be used to send task-related data or local files to an external network endpoint.

manage-taskboard