jira-browser-fetch
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill launches browser executables using
child_process.spawnto enable remote debugging. This is used for the legitimate purpose of extracting Atlassian session cookies from a local browser instance. - [PROMPT_INJECTION]: The skill processes untrusted external data from Jira issues and attachments, posing an indirect prompt injection surface.
- Ingestion points: Jira REST API, HTML, and XML content fetched in
scripts/jira-browser-fetch.js. - Boundary markers: Absent; data is archived in raw form.
- Capability inventory: Spawns browser processes and writes to the local file system.
- Sanitization: Absent; the tool is designed for raw data archival without modification.
Audit Metadata