jira-administration

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the application's source code and Jira issue descriptions to derive functional modules for component synchronization.
  • Ingestion points: In references/components.md, the agent is instructed to read UI and API routes (e.g., app/**/page.tsx, app/api/**/route.ts) and project Epics or Stories via bun run jira:sync-issues pull to identify product areas.
  • Capability inventory: The skill can write to the local filesystem (plan files in .context/reports/ and catalogs in .agents/), execute local scripts, and perform Jira mutations through the REST API.
  • Boundary markers: The skill enforces a "sealed mutation contract" where the agent must author a plan file and wait for explicit user approval before executing any changes with the --apply flag.
  • Sanitization: No specific sanitization or escaping of the content read from the codebase or Jira issues is mentioned before it is processed by the agent's logic.
  • [EXTERNAL_DOWNLOADS]: The skill downloads a manifest file and reference catalogs from GitHub during the instance migration workflow.
  • Source: Fetches jira-required.yaml from raw.githubusercontent.com. The specific URL path is dynamically extracted from scripts/sync-jira-workflows.ts at runtime.
  • Usage: The manifest is used to compare local configurations against upstream baselines before regenerating Jira catalogs.
  • [COMMAND_EXECUTION]: The skill utilizes several local scripts and standard system utilities to perform environment audits and synchronization tasks.
  • Scripts: Executes local TypeScript files using bun, such as scripts/sync-jira-components.ts, scripts/sync-jira-fields.ts, scripts/sync-link-types.ts, and scripts/sync-workflows.ts.
  • System Utilities: Uses grep, jq, curl, and ps for tasks like searching the codebase for hardcoded IDs, verifying reachable URLs, and inspecting the process environment for stale variables.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 08:14 PM
Security Audit — agent-trust-hub — jira-administration