The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: Reads Jira ticket summaries, descriptions, and comments (Step 2); processes PR bodies, commit messages, and repository glossaries (Step 3 & 4).
Boundary markers: Absent. The workflow does not specify the use of delimiters or 'ignore' instructions when processing these external text blocks.
Capability inventory: Jira write access (via addCommentToJiraIssue), Git CLI operations (diff, log, etc.), and local file system writes to the docs/ directory.
Sanitization: Absent. There is no evidence of input validation or escaping for the content retrieved from Jira or Git before it is processed or used to generate scenarios.
[DYNAMIC_EXECUTION]: In Step 1, the skill attempts to find a Jira connector by checking for a 'script or command the repo instructions name for Jira'. Executing commands from arbitrary repository-level configuration files constitutes a dynamic execution risk if the repository is untrusted or compromised.
[DATA_EXFILTRATION]: While the skill primarily interacts with the targeted Jira ticket, it accesses sensitive internal data including Jira issue details, project comments, and full source code history (diffs and commit messages). This creates a path where sensitive code or business decisions could be summarized and moved between the local environment and the Jira platform.

qa-scope