The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from Jira issue descriptions and comments without explicit sanitization or boundary markers.
Ingestion points: Untrusted content is retrieved from Jira issue fields and comments using acli commands as specified in workflows/refine-issues.md.
Boundary markers: The workflow instructions do not define delimiters (e.g., XML tags or specific markers) to isolate external Jira content from the agent's internal reasoning.
Capability inventory: The skill has the capability to read Jira data and propose write operations (updates to status, assignee, and comments) via the /mutation-gate and /rhdh-jira-update skills.
Sanitization: There is no mention of sanitizing, escaping, or filtering the content of Jira issue descriptions and comments before they are analyzed for refinement logic.
Mitigation: The risk of automated malicious actions is mitigated by a required user confirmation step (Apply changes? [y/N/edit]) before any mutation is executed.

rhdh-jira-refine