jira-fix-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external, untrusted content from Jira issues which could contain malicious instructions designed to exploit the agent's extensive capabilities.
- Ingestion points: Stage 1 retrieves data from the Jira API or cache, including the issue title, description, repro steps, and user comments (SKILL.md).
- Boundary markers: There are no explicit delimiters or 'ignore' instructions provided when the agent processes the retrieved Jira content.
- Capability inventory: The skill has access to shell execution via bash (Stages 0, 7, 8, 9, 10), Git operations (PR creation, merging), and the ability to write back to Jira (Stage 10).
- Sanitization: While the skill uses clarifying questions for logical alignment, it does not specify sanitization or escaping techniques for the external Jira strings before they are processed or used in analysis output.
- [CREDENTIALS_UNSAFE]: The skill references a local file path for Jira Personal Access Tokens (PAT) at '~/.config/jira-certs/jira-pat.txt' as part of its authentication contract. Accessing local credential files, while part of the documented workflow, presents a risk of sensitive data exposure.
Audit Metadata