Jira Workflow Steward
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill focuses on enforcing delivery operations best practices, such as linking commits and branches to Jira tasks, which enhances auditability and security hygiene.
- [EXTERNAL_DOWNLOADS]: The skill references the official Gitmoji website and repository (gitmoji.dev and carloscuesta/gitmoji) as standard references for commit formatting. These are well-known technology resources used for developer workflow standardization.
- [COMMAND_EXECUTION]: Includes a bash script template for a Git hook designed to validate branch names and commit subjects. The script performs local regex checks and does not perform network operations or access sensitive system files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Jira task identifiers and descriptions. The risk is mitigated by the following design factors:
- Ingestion points: Jira task IDs and descriptions provided by the user or external tools (SKILL.md).
- Boundary markers: The skill uses strict formatting patterns and regex validation for commit subjects and branch names, which acts as a delimiter for user-provided strings.
- Capability inventory: The agent's capabilities are limited to generating structured Git artifacts (branch names, commit messages, PR templates) and providing process guidance.
- Sanitization: Employs specific regex validation (branch_regex and commit_regex) within its provided Git hook to ensure inputs conform to expected delivery structures.
Audit Metadata