The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources to generate implementation plans. An attacker could embed malicious instructions in a ticket description or project convention files (like CLAUDE.md) that the agent might follow.
Ingestion points: The skill reads ticket keys, descriptions, and acceptance criteria (Step 1: Intake), as well as project convention docs (CLAUDE.md, AGENTS.md, CONTRIBUTING.md) and existing source code (Step 2: Research).
Boundary markers: There are no explicit markers or instructions to isolate untrusted data from the agent's core instructions.
Capability inventory: The skill has the ability to read/write files and execute commands to reproduce issues.
Sanitization: No data validation or sanitization is performed on the ingested content.
[COMMAND_EXECUTION]: The skill's research process (Step 2, Point 5) instructs the agent to "reproduce the symptom" for fix-type tickets. This involves executing commands that are often derived from untrusted ticket descriptions, which could be used to trigger arbitrary command execution on the host machine.
[COMMAND_EXECUTION]: The file references/orchestration.md contains a JavaScript code block designed for a platform-specific workflow tool. This script dynamically orchestrates sub-agents and executes logic within the agent's runtime environment to process plan reviews.

plan-ticket