The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell scripts and Python processes to interact with the Jira API. All user-supplied inputs, such as issue keys and JQL queries, are strictly validated using regular expressions or passed safely through Python's json module to prevent shell injection or payload manipulation.
[EXTERNAL_DOWNLOADS]: The jira-get-attachment-content.sh script facilitates downloading files from Jira. It includes a multi-layered security approach: a 10MB file size limit, hostname validation to ensure downloads originate only from the configured JIRA_URL (SSRF protection), and filename sanitization that strips path traversal sequences and hidden file markers.
[CREDENTIALS_UNSAFE]: The skill relies on a .env file for API tokens. This is managed by a custom loader (load-env.sh) that implements an allowlist for environment variable names, rejects values with control characters, and performs file permission checks to warn users if the credential file is world-readable.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data as it fetches issue descriptions and comments from Jira.
Ingestion points: Issue content retrieved via jira-get-issue.sh, jira-get-comments.sh, jira-get-fields-max.sh, and jira-search.sh.
Boundary markers: Absent in the raw script output; the skill relies on the agent's internal reasoning and the explicit 'READ-ONLY' constraints defined in SKILL.md.
Capability inventory: Limited to network GET/POST requests to the Jira API and local file writes to a tmp/ directory for attachments.
Sanitization: The scripts do not interpret the content; they return structured JSON data. The risk is assessed as minimal due to the read-only nature of the tools.

jira-integration