plan-jira-ticket
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell operations using
gitand the Atlassian CLI (acli) to manage branches and update Jira ticket statuses. - [DYNAMIC_CONTEXT_INJECTION]: The skill interpolates user-provided data (
$ARGUMENTS) directly into shell command templates, such as`acli jira workitem view $ARGUMENTS`and`acli jira workitem update $ARGUMENTS --status "In Progress"`inSKILL.md. A malicious user could provide a crafted ticket ID (e.g.,PROJ-123; malicious_command) to execute arbitrary commands on the underlying system. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted data from external Jira tickets (summary, description, and acceptance criteria), which may contain instructions targeting the agent's behavior.
- Ingestion points: Output from the
acli jira workitem viewcommand inSKILL.md. - Boundary markers: None are present to distinguish between legitimate ticket data and potentially malicious embedded instructions.
- Capability inventory: File system access via
git(branch creation and checkout) and network interaction viaacli(ticket status updates) inSKILL.md. - Sanitization: There is no evidence of sanitization, validation, or escaping of the content retrieved from Jira before it is processed by the agent.
Audit Metadata