address-ticket

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches ticket data and file attachments from Atlassian's JIRA servers and retrieves design metadata and exported assets from Figma.
  • [COMMAND_EXECUTION]: The skill executes various system commands to interact with development infrastructure, including git for branch management, acli (Atlassian CLI) for JIRA operations, fcli (Figma CLI) for design retrieval, and curl for API interactions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (JIRA and Figma) that is passed to sub-agents for analysis and code generation.
  • Ingestion points: JIRA ticket fields, comments, and attachments are ingested in Phase 1 (Step 3); Figma design trees and metadata are ingested in Phase 1 (Step 4).
  • Boundary markers: Absent; the instructions do not specify delimiters to separate untrusted JIRA/Figma content from instructions in sub-agent prompts.
  • Capability inventory: The skill spawns sub-agents with capabilities to write requirements documents, unit tests, and production code in Phase 3 (Steps 15 and 16).
  • Sanitization: Absent; external data is interpolated into agent prompts without explicit sanitization or filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:27 AM