sr-connect
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the ScriptRunner Connect CLI and related libraries from the NPM registry using tools like
npxand global package managers. These resources belong to the verified@sr-connectvendor scope. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage integration lifecycles, including checking for tool updates, cloning workspace repositories, and pushing local script modifications to the remote SRC platform.
- [REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to manage the deployment and execution of TypeScript code on a remote, managed V8 environment. It supports triggering scripts programmatically and interacting with external third-party APIs via managed connections.
- [INDIRECT_PROMPT_INJECTION]: The skill processes events and webhooks from various external applications (e.g., Jira, Slack, GitHub), creating a surface for indirect prompt injection. To mitigate this risk, the documentation provides extensive patterns for actor-based filtering, project-scoping, and loop-prevention logic to be implemented within integration scripts.
- [CREDENTIALS_UNSAFE]: The skill manages sensitive API keys and OAuth tokens. It implements secure patterns by instructing the use of environment variables and
stdinfor authentication to prevent secrets from appearing in command-line arguments or shell history, and includes explicit warnings against logging credentials.
Audit Metadata