confluence — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited confluence (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interact with Confluence Cloud to search pages, read documentation, create or update content, and browse spaces.
Do NOT check authentication upfront. Just run the command. If it fails with an auth error, see the Self-Healing section for diagnostics.
NEVER print, echo, or log the values of `ATLASSIAN_API_TOKEN`, `ATLASSIAN_EMAIL`, or any credentials. Only check whether they are set (e.g., test -n), never display their contents.
Prefer raw curl for all operations. acli has limited Confluence coverage (page view by ID, space list/view only) — fall back to it only for those read operations if curl fails. All write operations require curl.
Two API versions are in use. Use the correct one for each operation:
| API | Base URL | Used for |
|---|---|---|
| v1 | https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/rest/api/... | CQL search only |
| v2 | https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/... | Everything else |
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/..."curl (v1 API) — acli does not support CQL search.
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/rest/api/search?cql=type%3Dpage+AND+title+~+%22search+term%22"See cql-recipes.md for common CQL patterns.
curl (v2 API):
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages/{id}?body-format=storage"acli (fallback):
acli confluence page view --id {id} --body-format storage --jsoncurl only (v2 API):
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/spaces/{space-id}/pages"curl (v2 API):
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/spaces"acli (fallback):
acli confluence space list --jsoncurl (v2 API):
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/spaces/{id}"acli (fallback):
acli confluence space view --key KEY --jsoncurl only (v2 API):
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages/{id}/footer-comments"All write operations require curl. acli does not support Confluence page create, update, or comments.
curl:
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-X POST \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages" \
-d '{
"spaceId": "123456",
"status": "current",
"title": "Page Title",
"body": {
"representation": "storage",
"value": "<p>Page content in storage format.</p>"
}
}'See storage-format.md for how to construct the body value.
curl — You MUST GET the page first to obtain the current version number, then PUT with version.number + 1.
# Step 1: GET current page (note the version number in the response)
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages/{id}?body-format=storage"
# Step 2: PUT with incremented version
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-X PUT \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages/{id}" \
-d '{
"id": "{id}",
"status": "current",
"title": "Page Title",
"body": {
"representation": "storage",
"value": "<p>Updated content in storage format.</p>"
},
"version": {
"number": CURRENT_VERSION_PLUS_ONE
}
}'Never guess the version number. Always GET first.
curl -s -u "$ATLASSIAN_EMAIL:$ATLASSIAN_API_TOKEN" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-X POST \
"https://$ATLASSIAN_DOMAIN.atlassian.net/wiki/api/v2/pages/{id}/footer-comments" \
-d '{
"body": {
"representation": "storage",
"value": "<p>Comment text here.</p>"
}
}'?body-format=storage to get the body content./wiki/rest/api/search?cql=... for search. All other operations use v2 at /wiki/api/v2/.See cql-recipes.md for a full reference of CQL search patterns, including:
See storage-format.md for the Confluence XHTML storage format reference, needed for creating and updating pages. Covers:
If an API call or acli command fails:
Check which auth paths are available — never print token or credential values:
# Check if env vars are set (NOT their values)
test -n "${ATLASSIAN_DOMAIN:-}" && echo "ATLASSIAN_DOMAIN is set" || echo "ATLASSIAN_DOMAIN is NOT set"
test -n "${ATLASSIAN_EMAIL:-}" && echo "ATLASSIAN_EMAIL is set" || echo "ATLASSIAN_EMAIL is NOT set"
test -n "${ATLASSIAN_API_TOKEN:-}" && echo "ATLASSIAN_API_TOKEN is set" || echo "ATLASSIAN_API_TOKEN is NOT set"# Check acli (optional)
command -v acli && acli auth statusIf neither auth path is available, tell the user:
To use Confluence, set these environment variables:
>
``bash export ATLASSIAN_DOMAIN="yourcompany" # yourcompany.atlassian.net export ATLASSIAN_EMAIL="[email protected]" export ATLASSIAN_API_TOKEN="your-token" ``>
Generate an API token at: https://id.atlassian.com/manage/api-tokens
acli confluence [command] --help for current flags and syntax.https://developer.atlassian.com/cloud/confluence/rest/v2/https://developer.atlassian.com/cloud/acli/reference/commands/type = page AND title ~ "onboarding".~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.