youtrack-apps-skill
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by the official vendor and uses legitimate vendor resources, including npm packages under the @jetbrains scope and the plugins.jetbrains.com domain.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages YouTrack API tokens and Marketplace secrets. It explicitly instructs against printing or logging these values and recommends using secure environment variables or .env files.
- [INDIRECT_PROMPT_INJECTION]: The skill provides tools to process user-generated content from YouTrack issues and articles. This is a functional requirement for YouTrack apps but constitutes an attack surface.
- Ingestion points: Issue summaries, descriptions, and comments (references/api/entities.md).
- Boundary markers: The skill relies on standard YouTrack API entity isolation.
- Capability inventory: Support for REST requests, outgoing HTTP connections (references/api/http.md), and entity modification.
- Sanitization: Employs platform-native rendering and validation (e.g., renderMarkup).
Audit Metadata