The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes the jira CLI to manage issues, sprints, and workflow states. It also runs which jira for backend detection and uses command substitution (e.g., $(jira me)) for identifying the current user.
[REMOTE_CODE_EXECUTION]: The documentation in references/mcp.md directs the agent to execute a script at ~/.claude/skills/jira/jira-link-issues. This script is not provided within the skill source, making its operations unverifiable and posing a risk of executing unvetted local code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Jira, such as issue descriptions and comments, which could contain malicious instructions.
Ingestion points: Data enters the agent's context through tools like jira issue view, jira issue list, and mcp__atlassian__getJiraIssue.
Boundary markers: There are no explicit delimiters or specific instructions (like 'ignore embedded instructions') to protect the agent from interpreting data as commands.
Capability inventory: The skill possesses extensive system capabilities including shell execution (jira CLI), temporary file creation (/tmp/jira_body.md), and network access via API tools and curl.
Sanitization: External data is interpolated directly into prompts without sanitization or validation.
[DATA_EXFILTRATION]: In references/mcp.md, the skill uses curl to interact with the Jira API, passing sensitive environment variables ($JIRA_API_TOKEN) on the command line. Network requests to non-whitelisted domains that include secrets are a noted exfiltration risk.

jira