The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from various untrusted or semi-trusted external sources, such as Jira tickets, GitHub PR descriptions, Confluence pages, and Datadog logs. This ingestive behavior creates a surface for indirect prompt injection attacks where a malicious actor could embed instructions within these platforms to subvert the agent's behavior.
Ingestion points: As detailed in references/investigation.md, the skill reads from Jira, GitHub, Confluence, Datadog, and the local repository.
Boundary markers: While the skill includes some technical verification rules (e.g., checking if file paths exist), it lacks explicit delimiters or instructions to ignore embedded prompts within the text of retrieved tickets or documents.
Capability inventory: The skill has read access to the codebase and write access to Jira via tools like editJiraIssue or the acli CLI tool. The --direct mode allows the agent to write directly to Jira without a user preview, which increases the impact of a successful injection.
Sanitization: No specific sanitization or filtering of external content is documented to prevent the execution of embedded instructions.
[COMMAND_EXECUTION]: The skill references the use of command-line tools like acli (Atlassian CLI) and various MCP-based tool calls for interacting with external services and the project environment. These capabilities allow the agent to execute operations based on its interpretation of external data and codebase state.

writing-tickets