The Agent Skills Directory

[DATA_EXFILTRATION]: Communication with external APIs (Jira and Bitbucket) is restricted to the documented sync functions. The implementation includes defer-mutation.js to redact credentials from logs and state files, demonstrating a high level of security awareness and preventing accidental credential leakage.\n- [COMMAND_EXECUTION]: Local tool interactions (git, gh) are performed using safe execution methods like execFileSync and spawnSync with explicit argument arrays, which prevents shell injection vulnerabilities during automated operations.\n- [DYNAMIC_EXECUTION]: The use of Python and Node.js for configuration parsing is constrained to hardcoded logic within the skill's reference files. The Python reader specifically includes hardening logic to clear sys.path to prevent local library hijacking attacks, and environment variables are filtered before being passed to subprocesses.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted markdown data from the local repository but treats it as raw text for structural transformation into Atlassian Document Format (ADF). This conversion process effectively sanitizes the input by ensuring it is treated as data rather than instructions before it is transmitted to the Jira API.

sync-jira-task