jira-administration
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill dynamically fetches a configuration manifest from a GitHub URL derived from local script files to perform version comparisons.\n
- Evidence:
curl -fsSL "$UPSTREAM" -o /tmp/jira-required.upstream.yamlinreferences/instance-migration.md. The domainraw.githubusercontent.comis used to retrieve repository content.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Jira REST APIs and GitHub manifests, which could contain malicious instructions. It relies on user approval and plan-based workflows to mitigate this risk.\n - Ingestion points: Jira REST API endpoints and remote YAML manifests.\n
- Boundary markers: The skill follows a "sealed mutation contract" requiring explicit user confirmation before any modification is applied.\n
- Capability inventory: The skill can execute local scripts, utilize the Atlassian CLI (
acli), and modify project-level configuration files.\n - Sanitization: Uses intermediate JSON plan files and dry-run modes to allow for human review before execution.\n- [COMMAND_EXECUTION]: The skill executes various shell commands to perform audits, process data, and run synchronization scripts.\n
- Evidence: Commands such as
grep,awk,curl, andbunare used throughout the administration and migration phases.
Audit Metadata