fetching-work-item
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official documentation from well-known and trusted services, including Atlassian, GitHub, and Anthropic, to provide the agent with just-in-time information on API syntax and best practices.
- [COMMAND_EXECUTION]: Utilizes the standard
ghCLI and dedicated Jira MCP tools to perform read-only queries. These operations are restricted to retrieving work-item data as part of the skill's primary function. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from external sources and implements appropriate safeguards.
- Ingestion points: External content from GitHub issues and Jira tickets (handled in
subagents/work-item-retriever.md). - Boundary markers: Employs a structured Markdown template (
references/github-snapshot-template.md,references/jira-snapshot-template.md) with a specific preamble and metadata tables. - Capability inventory: Limited to writing a single local file in the
docs/directory per work item. - Sanitization: Includes a robust 'Heading rewrite' rule in
references/retrieval-playbook.mdthat transforms external Markdown headings into bold labels, preventing external content from mimicking the snapshot's reserved section headers.
Audit Metadata