The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it uses untrusted content from Jira to define the scope and instructions for its research tasks.
Ingestion points: In Step 1 of the loop, the skill retrieves the description and comments of Jira tickets using the acli command-line tool.
Boundary markers: The instructions do not provide delimiters or specific guidance to the model to treat the retrieved ticket content as data or to ignore any embedded instructions.
Capability inventory: The skill grants the agent access to search the local filesystem (Grep/Glob/Read), use mempalace_search, and query several database skills (pricepoint-db-staging, -prod, -dev). A successful injection could leverage these to access sensitive information.
Sanitization: While the ticket keys are validated against a specific regex, the body of the comments—which guides the "Identify the question" and "Research" phases—undergoes no sanitization or instruction-filtering.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with Jira via the acli tool. Although the parameters are regex-validated to prevent direct command injection, relying on external CLI tools for data ingestion increases the overall attack surface.

Jira-loop