The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/tickets.sh file uses a shell heredoc to execute a large block of Python code at runtime. This pattern incorporates logic that is not stored in a standalone .py file, which is a technique that can be used to hide execution behavior from simple file-based scanners.
[DATA_EXFILTRATION]: The skill's Jira integration in scripts/tickets.sh sends sensitive credentials (JIRA_EMAIL, JIRA_API_TOKEN) to a remote endpoint specified by the JIRA_BASE_URL environment variable. The skill lacks validation for this URL, creating a risk that credentials could be sent to an attacker-controlled server if the variable is misconfigured or maliciously set.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external issue trackers (GitHub, Linear, Jira) including titles, descriptions, and comments. This data is passed to the agent without boundary markers or sanitization, potentially allowing external content to influence agent behavior.
Ingestion points: External issue content is fetched in scripts/tickets.sh via the view, list, and next subcommands.
Boundary markers: The instructions do not define delimiters or "ignore instructions" markers for the ingested external text.
Capability inventory: The skill possesses network access via urllib and gh, file system write access to CLAUDE.md and AGENTS.md, and shell command execution capabilities.
Sanitization: No filtering or sanitization is performed on the text content retrieved from the external APIs before it is presented to the agent.
[COMMAND_EXECUTION]: The SKILL.md file executes numerous shell commands during its "Stage 1: Detect" phase, including git, gh, ls, env, and sed. These commands are used to discover the environment and existing configuration but constitute a significant execution surface within the skill.

setup-mana