The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill features a potential attack surface for indirect prompt injection by processing untrusted data from external sources.
Ingestion points: In Step 1, the skill fetches data from Jira tickets (Gate 1) and GitHub Pull Requests, comments, and user-provided URLs (Gate 2).
Boundary markers: There are no explicit instructions or delimiters mentioned to isolate external content from the agent's instructions.
Capability inventory: The skill possesses significant capabilities, including executing shell commands via Bash, spawning sub-agents via Agent, and invoking other automation skills via Skill.
Sanitization: The instructions do not specify any sanitization, filtering, or escaping of the ingested external content.
[EXTERNAL_DOWNLOADS]: The skill retrieves data from well-known and trusted development services.
It uses the gh CLI to interact with GitHub APIs and the wk-jira skill to fetch ticket details from Jira. These operations are limited to data retrieval for context gathering.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform codebase research, such as using grep and find. This is within the scope of its research and planning functions.
[CREDENTIALS_SAFE]: The skill includes a 'Secret-ownership probe' (Step 2.5) that explicitly instructs the agent to identify provisioning modes for secrets and warns against inventing infrastructure code for secrets, advocating for manual population or repository automation as operational prerequisites.

wk-plan