jira-sprint-retrospective
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (Jira issues and Git commits) to generate retrospective reports. Ingestion points: Jira issue data is fetched via
scripts/compile-retro-data.shand Git commit history viascripts/collect-git-activity.sh. Boundary markers: Data is interpolated into Markdown without specialized delimiters or 'ignore embedded instructions' warnings for untrusted content. Capability inventory: The skill can write files to the repository and perform network operations viacurl. Sanitization: Basic sanitization is performed via JQ filters likeclean_textto flatten ADF andescto ensure Markdown table safety. - [EXTERNAL_DOWNLOADS]: The skill fetches data from trusted Atlassian services (Jira and Bitbucket) using environment-provided URLs and credentials. These activities are neutrally documented as they are necessary for the skill's primary function.
- [COMMAND_EXECUTION]: The skill executes local scripts and system tools (
git,jq,node) mapped to its core functionality for data synthesis and report generation. - [CREDENTIALS_UNSAFE]: The skill utilizes environment variables for sensitive API tokens and includes a dedicated redaction utility (
references/defer-mutation.js) designed to prevent credential leakage in command logs and journaled actions.
Audit Metadata