The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external workplan specifications which could contain adversarial instructions intended to influence the agent's behavior during the decomposition and ticket creation process.
Ingestion points: The skill reads content_markdown from external workplan resources via the wp --json workplan show <slug> command in Step 1.
Capability inventory: The agent has capabilities to read repository files (implementation, glossary, ADRs, tests), write to temporary markdown files, and execute ticket creation commands through the wp CLI tool.
Boundary markers: The skill lacks explicit instructions or delimiters to ensure the agent ignores instructions embedded within the source content_markdown while processing it.
Sanitization: No sanitization, validation, or filtering mechanisms are defined for the content retrieved from the stored workplans before it is used to generate ticket bodies and command arguments.
[COMMAND_EXECUTION]: The skill's primary functionality involves constructing and executing complex commands via the wp CLI tool using parameters derived from external data.
The wp --json ticket create command is invoked with several flags (--workplan, --slug, --title, --type, --project, --label, --prerequisite) that are populated with values derived from the spec and repository analysis.
Although the skill defines strict rules for slug generation (lowercase ASCII, hyphen replacement, 63-byte limit) and graph validation (cycle detection, prerequisite ordering), the reliance on external input for command arguments remains a potential surface for command injection if the input is not correctly handled by the underlying wp tool.

ai-to-tickets-workplan