The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks because it processes data from an external Jira instance.\n
Ingestion points: Untrusted data enters the agent context via scripts/jira-view.sh (issue details and comments), scripts/jira-list.sh, and scripts/jira-search.sh.\n
Boundary markers: No boundary markers or specific 'ignore embedded instructions' warnings are used when presenting Jira content to the agent.\n
Capability inventory: The skill has extensive capabilities including subprocess calls to the jira CLI for creating (jira-create.sh), updating (jira-update.sh), and transitioning (jira-transition.sh) issues, as well as raw API access (jira-api.sh).\n
Sanitization: Scripts use jq to parse and build JSON structures, providing protection against typical injection in those fields, but the text content of issues is not sanitized or escaped to prevent command-like behavior in the LLM.\n- [COMMAND_EXECUTION]: A command injection vulnerability exists in scripts/jira-create.sh due to unquoted variable expansion.\n
Evidence: In scripts/jira-create.sh, the command LABEL_OUTPUT=$(jira labels set "$ISSUE_KEY" $ALL_LABELS 2>&1) expands the $ALL_LABELS variable without quotes. If the agent is manipulated into passing a string containing shell metacharacters (e.g., semicolons or backticks) as a label, it will lead to arbitrary code execution in the shell.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external CLI tool.\n
Evidence: Documentation and error messages in scripts/_config.sh and SKILL.md direct users to install the go-jira CLI from its official GitHub repository using brew install or go install. This is documented neutrally as a requirement for the skill's primary purpose.

jira