jira-impl-logger
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local git commands such as 'git diff', 'git log', and 'git show' to retrieve code statistics, file paths, and commit history. These are standard operations for generating implementation logs and are confined to the repository context.
- [EXTERNAL_DOWNLOADS]: The skill documentation refers to an external GitHub repository ('Pimzino/spec-workflow-mcp') for its artifact schema. This reference is used for documentation purposes and does not involve automated software downloads or remote script execution.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. Ingestion points: Data is pulled from JIRA ticket descriptions and git commit messages. Boundary markers: No explicit delimiters or warnings to ignore instructions within inputs are specified. Capability inventory: The skill is permitted to read and write JIRA comments and labels via the Atlassian MCP. Sanitization: No specific filtering or validation of the ingested text is mentioned. The risk is assessed as low because the skill's actions are restricted to informational reporting.
- [SAFE]: The skill's functionality is consistent with its stated purpose, and it relies on authorized MCP tools to interact with external services, ensuring data operations occur within the user's established environment.
Audit Metadata