address-ticket
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches ticket data and file attachments from Atlassian's JIRA servers and retrieves design metadata and exported assets from Figma.
- [COMMAND_EXECUTION]: The skill executes various system commands to interact with development infrastructure, including
gitfor branch management,acli(Atlassian CLI) for JIRA operations,fcli(Figma CLI) for design retrieval, andcurlfor API interactions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (JIRA and Figma) that is passed to sub-agents for analysis and code generation.
- Ingestion points: JIRA ticket fields, comments, and attachments are ingested in Phase 1 (Step 3); Figma design trees and metadata are ingested in Phase 1 (Step 4).
- Boundary markers: Absent; the instructions do not specify delimiters to separate untrusted JIRA/Figma content from instructions in sub-agent prompts.
- Capability inventory: The skill spawns sub-agents with capabilities to write requirements documents, unit tests, and production code in Phase 3 (Steps 15 and 16).
- Sanitization: Absent; external data is interpolated into agent prompts without explicit sanitization or filtering.
Audit Metadata