The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from Jira, including issue summaries and sprint goals, and interpolates them directly into generated Markdown reports. While the risk is minimal given the reporting context, this creates a potential surface for indirect prompt injection if an attacker-controlled issue summary contains malicious instructions intended for the AI agent.
Ingestion points: Jira API responses containing issue details are fetched in scripts/compile-sprint-review-data.sh and references/jira-sprint-lib.sh.
Boundary markers: Interpolated content is structuralized using Markdown formatting (e.g., - **[KEY]** summary), but there are no explicit boundary markers or instructions to the agent to disregard embedded commands in the external data.
Capability inventory: The skill possesses capabilities to perform authenticated network requests to Jira and execute shell scripts for data processing.
Sanitization: The skill uses jq to ensure data is correctly formatted as strings/JSON, but it does not perform semantic sanitization to strip potential instructional patterns or Markdown control characters from the ingested summaries.
[SAFE]: The skill follows robust security best practices for handling sensitive credentials and managing access controls.
Credential Management: Jira API tokens are retrieved from environment variables and processed into authentication headers in memory to prevent exposure in process lists or logs.
Auditing and Redaction: The skill includes an extensive local auditing framework (defer-mutation.js) that automatically redacts secrets (matching patterns for Base64, Bearer tokens, GitHub PATs, and Atlassian tokens) from generated logs and journals.
Access Control: The platform resolution logic (resolve-platform.sh and read-config.sh) provides a granular access control system (e.g., read-only vs full access) that fails closed to the most restrictive mode if configurations are missing or unreadable.

jira-sprint-review-prep