The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Atlassian sources to drive automated workflows, creating a surface for injection attacks.
Ingestion points: In references/common-workflows.md, the triageNewIssue function reads the summary and description fields from Jira issues. The syncMeetingNotes function reads the body.storage.value from Confluence pages.
Boundary markers: Absent. The code snippets analyze the ingested text using simple regular expressions and lowercase matching without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has significant write permissions, including jira_update_issue, jira_add_comment, jira_create_issue, confluence_create_page, and confluence_update_page (seen in references/common-workflows.md).
Sanitization: Absent. While escapeHtml is used for display purposes, no sanitization or validation is performed to prevent the AI agent from interpreting instructions contained within the Jira or Confluence data.
[EXTERNAL_DOWNLOADS]: The skill recommends installing and running third-party MCP servers from external developers.
The SKILL.md file provides a configuration example that uses npx -y @sooperset/mcp-atlassian to download and execute code.
references/mcp-server-setup.md suggests several alternatives, including mcp-atlassian (via uvx or pip) and atlassian-mcp (via npm), which pull code from public registries at runtime.
[REMOTE_CODE_EXECUTION]: The use of npx -y and uvx in the recommended setup patterns constitutes dynamic download and execution of remote code. While this is common for MCP tool integration, it allows for the execution of arbitrary code from the package maintainers.

atlassian-mcp