The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the zentao-cli package via standard Node.js package managers (npm, bun, pnpm) if the tool is not already installed on the system. These resources are provided by the official vendor (easysoft).
[COMMAND_EXECUTION]: The skill instructions allow the agent to execute various zentao shell commands to manage products, projects, and tasks. This includes capabilities to create, update, and delete records, as well as uploading local files as attachments.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a ZenTao server, which may contain untrusted content such as bug descriptions or task requirements.
Ingestion points: Data enters the agent context through query commands like zentao bug, zentao story, and zentao task as specified in SKILL.md and references/data-output.md.
Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded within the project data retrieved from the server.
Capability inventory: The agent has the capability to execute shell commands (via the CLI) and read local files for attachment uploads, providing a path for potential action if an injection were successful.
Sanitization: There is no evidence of specific sanitization, filtering, or schema validation mentioned in the instructions for the content retrieved from the ZenTao API.

zentao-cli