The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of external, untrusted content from bug reports and comments.
Ingestion points: Untrusted data enters the agent's context through user-provided 'free text' inputs for milestone changes, requests, and bugs, as well as by reading comments from existing tickets via the wkc-tracker show command as described in SKILL.md sections 1 and 2.
Boundary markers: The skill utilizes Markdown templates to structure ticket output, but it lacks specific instructions or delimiters to isolate or ignore embedded instructions within the copied external text.
Capability inventory: The skill has the capability to perform various ticket operations (create, edit, move, link) through the wkc-tracker sub-skill and can trigger additional agent workflows via wkc-architect and wkc-plan as noted in SKILL.md sections 1 and 5.
Sanitization: The skill mandates that the agent copy evidence lines such as 'Observed' and 'Reproduce' word-for-word from external reports without providing instructions for sanitization or escaping, which could allow malicious instructions to be propagated into the ticketing system and influence downstream agents (SKILL.md section 2).

wkc-backlog