The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically ticket descriptions (content_markdown) and review reports from the Workplan tracker. This creates a surface for indirect prompt injection where malicious instructions hidden in a ticket could attempt to influence the agent's behavior during implementation or check execution.
Ingestion points: Data is pulled via wp --json ticket claim (Step 1) and wp --json review list (Step 2).
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to treat the ticket content or review text as data rather than instructions.
Capability inventory: The skill possesses significant capabilities, including executing shell commands for "required checks" (Step 4), modifying the local filesystem, performing git commits (Step 8), and writing to the external tracker via the wp CLI.
Sanitization: No sanitization or validation of the input text from the tracker is described.
[DYNAMIC_EXECUTION]: Step 4 instructs the agent to "Determine the repository's mandatory checks from its instructions and build files" and then execute them. This involves the dynamic execution of arbitrary commands or scripts defined within the worktree, which could lead to code execution if the repository contains malicious build configurations.
[COMMAND_EXECUTION]: The skill makes extensive use of the wp CLI tool to perform state changes on the Workplan tracker. While these are structured calls, they represent a side-effect capability that could be abused if the agent is misled by injected instructions.

ai-implement-workplan