The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from work item titles, descriptions, and labels, creating a potential surface for indirect prompt injection if this data is processed by downstream agents without proper delimitation.
Ingestion points: User-provided action payloads in handleAction and JSON data returned from the Plane API endpoints.
Boundary markers: The skill is explicitly instructed in SKILL.md to return only structured JSON and to never engage in dialogue or ask user questions.
Capability inventory: The skill performs network operations using fetch to read, create, and update work items on a Plane server.
Sanitization: The script uses JSON.stringify for outbound API data and performs basic HTML wrapping for descriptions.
[REMOTE_CODE_EXECUTION]: The package.json and bun.lock files contain development dependencies with anomalous version numbers (e.g., typescript@6.0.2, @types/node@24.7.2, c8@11.0.0) that are not available in public registries. These appear to be non-malicious placeholders or artifact generation errors. Because these are scoped to development metadata and the runtime code in plane.js is self-contained and does not dynamically load external code, there is no threat to the agent's execution environment.

plane-api