The Agent Skills Directory

[DATA_EXPOSURE]: The setup process involves passing a Jira API token as a command-line argument to the save_config.rb script. On multi-user systems, command-line arguments may be visible in process listings or persistent in shell history.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes content from Jira issues and comments which could contain malicious instructions.
Ingestion points: issues.rb, issue.rb, and comments.rb (fetches Jira descriptions and comments).
Boundary markers: Absent. External content is displayed directly to the agent.
Capability inventory: create_issue.rb, update_issue.rb, assign.rb, transition.rb, and add_comment.rb perform write operations.
Sanitization: Absent. Content is parsed from JSON and printed to standard output.
[SAFE]: The skill uses zero external dependencies (no gems), relying entirely on Ruby's standard library (json, net/http, uri, base64, fileutils), which eliminates supply-chain risks.
[SAFE]: User credentials (email and API token) are stored in ~/.config/jira/config.json with restricted filesystem permissions (0600), ensuring they are only accessible by the account owner.

jira