The Agent Skills Directory

[SAFE]: The skill provides a structured framework and toolset for standardizing project reporting. The primary logic is contained in scripts/status_generator.py, which is a transparent, well-documented script using only Python standard library modules. It does not perform any network operations, use unsafe deserialization, or execute external commands. Analysis shows the script safely reads a JSON input and formats it into various text-based outputs (Markdown, HTML, etc.).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (Jira/Linear JSON exports), which presents a theoretical surface for indirect prompt injection if the source data contains malicious instructions intended for the AI agent.
Ingestion points: Data enters the system via the --input JSON file processed by scripts/status_generator.py.
Boundary markers: The script does not implement explicit boundary markers or instructions to ignore embedded prompts in the formatted output, which is typical for a text formatting utility.
Capability inventory: The skill can write results to the local file system using the --output flag but lacks network access or dynamic code execution capabilities.
Sanitization: The script applies html.escape() for the Confluence output format, mitigating structural breakage in HTML, but provides no sanitization for other formats like Markdown or plain text. Given that processing external data is the primary purpose of the skill, this finding is considered low risk.

status-update-generator