risk-to-jira-transformer
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides examples of executing a Node.js script that takes user-supplied risk descriptions as command-line arguments. If executed via a shell without strict sanitization, characters such as semicolons, backticks, or pipes within the description could lead to arbitrary command execution on the host.\n- [PROMPT_INJECTION]: The skill's primary function is to interpret and extract data from unstructured natural language, which creates a surface for indirect prompt injection.\n
- Ingestion points: User-provided risk description strings in SKILL.md.\n
- Boundary markers: None provided in the command examples or instructions to the agent.\n
- Capability inventory: The skill uses the Bash, Read, Glob, Write, and Edit tools.\n
- Sanitization: No input sanitization or validation steps are described for the natural language processing phase.
Audit Metadata