atlassian-cloud-rest-api
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user queries to search local OpenAPI specifications, which creates an inherent attack surface for indirect prompt injection.
- Ingestion points: User questions regarding Atlassian REST API paths, parameters, or schemas as described in
SKILL.md. - Boundary markers: None identified in the skill instructions to separate user input from search commands.
- Capability inventory: The skill uses
ls,rg(ripgrep), andjqfor file system listing and JSON processing on bundled files. - Sanitization: No explicit sanitization or input validation logic is present for user-provided search terms.
- [EXTERNAL_DOWNLOADS]: The skill contains references to official Atlassian documentation sources.
- Evidence: Source URLs for the OpenAPI specs point to
https://dac-static.atlassian.cominreferences/SPECS.mdandassets/specs.json. - [SAFE]: No signs of obfuscation, malicious command execution, privilege escalation, or persistence were found. The skill operates on local documentation using standard utilities.
Audit Metadata