The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it processes data from an external, potentially attacker-controlled source (Jira Cloud).
Ingestion points: Data including issue summaries, descriptions, and comments are fetched from the Jira REST API via functions in scripts/jira_client.py (e.g., cmd_get, cmd_comments, cmd_search).
Boundary markers: The instructions in SKILL.md lack explicit delimiters or guidance to help the agent isolate external data from its core instructions.
Capability inventory: The skill possesses powerful capabilities, such as creating and editing issues and uploading attachments (cmd_attach). Combined with the agent's Bash, Read, and Write tool access, a malicious instruction embedded in a Jira issue could manipulate the agent into performing unauthorized actions, such as exfiltrating local files to Jira.
Sanitization: While the client converts Atlassian Document Format (ADF) to plain text, it does not sanitize the content for adversarial instructions before it is presented to the agent.

jira-connector