jira-administration
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the application's source code and Jira issue descriptions to derive functional modules for component synchronization.
- Ingestion points: In
references/components.md, the agent is instructed to read UI and API routes (e.g.,app/**/page.tsx,app/api/**/route.ts) and project Epics or Stories viabun run jira:sync-issues pullto identify product areas. - Capability inventory: The skill can write to the local filesystem (plan files in
.context/reports/and catalogs in.agents/), execute local scripts, and perform Jira mutations through the REST API. - Boundary markers: The skill enforces a "sealed mutation contract" where the agent must author a plan file and wait for explicit user approval before executing any changes with the
--applyflag. - Sanitization: No specific sanitization or escaping of the content read from the codebase or Jira issues is mentioned before it is processed by the agent's logic.
- [EXTERNAL_DOWNLOADS]: The skill downloads a manifest file and reference catalogs from GitHub during the instance migration workflow.
- Source: Fetches
jira-required.yamlfromraw.githubusercontent.com. The specific URL path is dynamically extracted fromscripts/sync-jira-workflows.tsat runtime. - Usage: The manifest is used to compare local configurations against upstream baselines before regenerating Jira catalogs.
- [COMMAND_EXECUTION]: The skill utilizes several local scripts and standard system utilities to perform environment audits and synchronization tasks.
- Scripts: Executes local TypeScript files using
bun, such asscripts/sync-jira-components.ts,scripts/sync-jira-fields.ts,scripts/sync-link-types.ts, andscripts/sync-workflows.ts. - System Utilities: Uses
grep,jq,curl, andpsfor tasks like searching the codebase for hardcoded IDs, verifying reachable URLs, and inspecting the process environment for stale variables.
Audit Metadata