The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to run eval "$(bash scripts/get-token.sh)", which executes the output of a local shell script to configure environment variables for the session.
[DYNAMIC_EXECUTION]: The get-token.sh helper script utilizes node -e to execute inline JavaScript for processing JSON data and managing the local token cache file.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from external ZenTao API endpoints, creating a potential surface for indirect prompt injection if retrieved data contains malicious instructions.
Ingestion points: The agent retrieves data from multiple modules including Story specifications, Bug steps, and Task descriptions as documented in api-reference.md.
Boundary markers: The skill does not define specific delimiters to isolate API-retrieved data from the agent's internal instructions.
Capability inventory: The skill has the ability to execute shell commands (via eval) and perform network requests (via curl).
Sanitization: There are no explicit instructions to sanitize or validate the content received from the API before it is processed by the agent.
[DATA_EXPOSURE]: The skill stores sensitive authentication tokens and server URLs in a local plain-text file at ~/.zentao-token.json for persistent access.

zentao-api