jira-integration

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation guides the installation of the mcp-atlassian package via the uvx tool. This is a standard integration method for Atlassian's Jira service and uses versioned packages from public registries.
  • [COMMAND_EXECUTION]: Provides several examples of curl commands used to interact with Jira's REST API. These examples demonstrate how to fetch, update, and transition tickets directly via the shell.
  • [PROMPT_INJECTION]: By fetching and analyzing external data from Jira tickets (descriptions, comments, etc.), the skill creates a surface for Indirect Prompt Injection. A malicious user could place instructions inside a Jira ticket that the agent might inadvertently follow when processing the ticket content.
  • Ingestion points: Data retrieved from jira_get_issue, jira_search, and direct REST API curl calls (SKILL.md).
  • Boundary markers: None present; the skill does not instruct the agent to use specific delimiters or ignore instructions within ticket content.
  • Capability inventory: Access to read, create, update, and transition Jira issues, and add comments (SKILL.md).
  • Sanitization: No sanitization or validation logic is provided for the content retrieved from Atlassian's APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 08:20 AM