The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded credentials were detected in a REST endpoint example script. While intended as dummy values for development, they use literal strings instead of required placeholders.
File: references/scripts/data-center/rest-endpoints/use-the-rest-endpoint-to-get-the-organizations-details.md
Evidence: final def username = 'admin' and final def password = 'q'
[INDIRECT_PROMPT_INJECTION]: Multiple scripts (e.g., references/scripts/cloud/listeners/add-comment-on-issue-created.md and references/scripts/cloud/post-functions/add-automated-comment-for-every-work-item-created-inside-a-jira-service-management-customer-portal.md) create a vulnerability surface for indirect prompt injection by interpolating untrusted Jira issue data into system actions.
Ingestion points: Data enters the context from issue fields like reporter.displayName and custom text fields.
Boundary markers: Data is often directly appended to strings without delimiters or instructions to ignore embedded commands.
Capability inventory: The scripts have the capability to post comments (addComment), send emails (Mail.send), and update work items.
Sanitization: No sanitization or escaping of the ingested issue content is performed.
[EXTERNAL_DOWNLOADS]: A utility script downloads a JAR file from an official Atlassian documentation URL for performance benchmarking.
File: references/scripts/data-center/script-console/a-console-script-viewing-filesystem-performance-of-your-local-and-shared-home-directories.md
Source: https://confluence.atlassian.com/jirakb/files/54362304/54591494/3/1444177154112/support-tools.jar
[REMOTE_CODE_EXECUTION]: The benchmarking script executes the downloaded JAR file using a subprocess call.
File: references/scripts/data-center/script-console/a-console-script-viewing-filesystem-performance-of-your-local-and-shared-home-directories.md
Method: "${javaHome}/bin/java -jar ${file.absolutePath}".execute()
[COMMAND_EXECUTION]: Several management scripts facilitate high-privilege operations such as deactivating users, changing permission schemes, and managing group memberships. While appropriate for administrative use, these operations should be closely monitored for unauthorized modification.

scriptrunner-example-scripts