The Agent Skills Directory

[SAFE]: No security issues detected. The skill performs localized data processing of Jira and GitHub records using deterministic scripts. While it processes untrusted content (ticket descriptions and PR comments), it includes robust and repeated instructions to the AI agent to ignore any embedded commands, effectively mitigating the risk of indirect prompt injection. Shell operations are restricted to authorized CLI tools and use secure argument passing to prevent injection attacks. Data management is handled through local ephemeral directories and user-configured local files, following privacy best practices.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface by ingesting untrusted data from multiple sources, but handles it securely.
Ingestion points: Jira ticket summaries, descriptions, and comments are fetched via jira_scan.py and Agent A; GitHub PR titles, bodies, and branch names are fetched via pr_scan.py and Agent F; external document metadata and content are processed by Agent G.
Boundary markers: Present and robust. The forecast/method.md and SHARED_BRIEF.md files provide explicit instructions to sub-agents to treat all external content as untrusted data and to ignore any instruction-shaped text found within items.
Capability inventory: The skill can execute shell commands (acli, gh, open, rm), write files to disk, and create/clean up localized work directories.
Sanitization: String cleaning is applied to tracker data via the _clean function in jira_scan.py. More importantly, command execution is performed using list-based argument passing (avoiding shell=True), and filename generation for reports is restricted to a sanitized alphanumeric slug format, preventing path traversal or shell injection.

team-pulse