The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates exclusively with the user-defined Atlassian domain to fetch Jira issue data, attachments, and Confluence pages. It includes a security filter that prevents the download of potentially harmful file types (such as .exe, .sh, or .bat) to mitigate risks from malicious attachments.
[COMMAND_EXECUTION]: Local scripts within the skill directory use child_process.execFileSync and spawnSync to call each other for validation tasks. These calls are implemented securely using argument arrays rather than shell strings, which effectively prevents command injection.
[PROMPT_INJECTION]: The skill processes untrusted text from Jira and Confluence but includes a mandatory security workflow to mitigate Indirect Prompt Injection. A subagent is given strict rules prohibiting wording changes, and a final validation step in the main thread compares the output against the original source using a word-normalized diff. This ensures that the AI cannot be tricked into adding malicious content or ignoring its instructions.
Ingestion points: Jira issue fields and Confluence page content retrieved via fetch-issue.mjs and fetch-confluence.mjs.
Boundary markers: The subagent-instruction.md template defines a strict "Never change the words" boundary.
Capability inventory: The subagent is restricted to formatting content within a specific local folder and does not have access to sensitive system paths or external networks.
Sanitization: Content is mechanically converted from structured Atlassian formats to Markdown. The primary control is the post-hoc word-diff validation which detects any additions or unauthorized changes to the text content.
[SAFE]: Atlassian API tokens and email addresses are handled securely through environment variables. No secrets are hardcoded or written to configuration files. The skill has no external runtime dependencies, minimizing supply chain vulnerabilities.

jira-to-local