The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks because it ingests untrusted data from external sources and local files, which the agent then processes to perform actions in Jira.
Ingestion points: The agent reads external content via acli jira workitem view and acli jira workitem search commands, as well as local files via the --from-file and --from-json flags.
Boundary markers: There are no specific instructions or delimiters provided to the agent to help it distinguish between data content and potentially malicious embedded instructions within tickets or files.
Capability inventory: The agent has the capability to execute shell commands (acli), read local files, and write output to the local file system (as demonstrated in the ticket-template.json example).
Sanitization: No sanitization or validation logic is defined to filter or escape the content retrieved from Jira or local files before the agent acts upon it.
[COMMAND_EXECUTION]: The skill's primary function is the execution of shell commands using the acli tool. While this is the intended design, it requires the agent to have command-line execution privileges and relies on the user's existing CLI authentication state (acli jira auth status).

jira