The Agent Skills Directory

[COMMAND_EXECUTION]: The jira-validate.py script uses subprocess.run to check the version of the uv tool. The command is static (uv --version) and is used solely for runtime environment verification.
[EXTERNAL_DOWNLOADS]: The jira-attachment.py script supports downloading issue attachments. It implements host-validation checks to ensure downloads originate from the configured Jira instance (mitigating SSRF) and verifies that output paths do not escape the working directory (mitigating path traversal).
[CREDENTIALS_UNSAFE]: The skill facilitates the storage of Jira API tokens and Personal Access Tokens in ~/.env.jira or ~/.jira/profiles.json. The setup script explicitly enforces restrictive 0600 (owner-only) filesystem permissions on these files, aligning with industry standards for CLI tool configuration.
[DATA_EXFILTRATION]: While the skill performs network operations to reach Jira APIs, it includes a dedicated _sanitize_error utility to redact authorization headers, bearer tokens, and passwords from any error messages that might be displayed or logged.

jira-communication