The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) as it ingests and acts upon untrusted data from external sources.
Ingestion points: The skill fetches Jira issue data and linked context using gdev-cli jira get-issue in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters used to warn the agent to ignore potentially malicious instructions embedded within the Jira descriptions.
Capability inventory: The skill has broad capabilities across multiple files, including code modification, Git operations (push, fetch), Jira state transitions (gdev-cli jira transition), and triggering CI pipelines via the Bitbucket REST API.
Sanitization: The skill does not mention any validation or sanitization steps for the data retrieved from Jira before processing or using it to influence downstream actions.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to manually extract and decode authentication credentials from a local configuration file.
Evidence: In SKILL.md, step 3 and step 5, the agent is told: "You should be able to find the token by decoding the base64 token from the gdev-cli config" and subsequently use it in an Authorization: Bearer <TOKEN> header for REST API calls. While this uses the vendor's own CLI configuration, instructing an AI to manually parse and decode secrets from local files is a high-risk operational pattern.

jira