The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes data from external Jira issues which may contain adversarial instructions.
Ingestion points: In SKILL.md (Stage 1: Read Jira), the skill reads data from Jira IDs, including titles, descriptions, repro steps, expected/actual results, and historical comments.
Boundary markers: The skill instructions do not specify the use of boundary markers, XML tags, or explicit "ignore embedded instructions" warnings when interpolating external Jira content into the agent's context.
Capability inventory: The skill possesses extensive capabilities that could be abused if an injection succeeds, including modifying business code (SKILL.md Stage 6), executing shell commands for builds and tests (SKILL.md Stage 7), performing Git operations like commits and branch creation, and writing back to external Jira tickets via API (SKILL.md Stage 8.4).
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from Jira before it is used to drive the fix implementation and verification steps.

opsx-jira-fix-workflow