skills/atlassian/twg-cli/twg/Gen Agent Trust Hub

twg

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of the twg CLI binary and the jq utility to perform its core data retrieval and processing tasks. This is the intended functional mechanism for the integration.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Atlassian product content. Ingestion points: SKILL.md and references/OUTPUT.md identify routes for fetching Jira issues, Confluence pages, and Bitbucket PRs. Boundary markers: The skill employs YAML envelopes and compact JSON summary files to delimit data. Capability inventory: Execution is restricted to twg and jq commands. Sanitization: The skill utilizes selective field projection (--select) and command-scoped presets (@compact, @evidence) to limit the raw text ingested by the agent.\n- [PRIVILEGE_ESCALATION]: references/OUTPUT.md provides a security advisory noting that environment-prefixed commands may bypass certain authorization controls in specific agent runtimes, which is documented as a guidance for runtime configuration rather than a malicious feature.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 03:30 AM