Security audit

Deployed Dev Acceptance

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent dev-acceptance testing workflow with optional, disclosed Jira posting that requires explicit user direction.

Install only if you intend to let the agent perform dev-site acceptance testing with browser sessions and, when you explicitly ask, use Jira credentials to post comments, upload screenshots, or move a Jira issue. Use least-privilege Jira and Bitbucket tokens, keep WORKFLOW_CONFIG and API tokens outside the repository, review the preview before --apply, and avoid granting transition permissions unless card status changes are part of your workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A second description/behavior mismatch exists because the document claims the skill's primary function is browser-based verification of deployed environments, yet substantial behavior is dedicated to generating and posting Jira acceptance content and manipulating attachments. This creates a confused-deputy risk where a user authorizes testing but the agent spends that authority on external Jira operations not clearly disclosed by the skill's top-level contract.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A second description/behavior mismatch exists because the document claims the skill's primary function is browser-based verification of deployed environments, yet substantial behavior is dedicated to generating and posting Jira acceptance content and manipulating attachments. This creates a confused-deputy risk where a user authorizes testing but the agent spends that authority on external Jira operations not clearly disclosed by the skill's top-level contract.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill directs the agent to read environment variables, access the network, and write local files, but it does not declare an explicit tool/permission scope. In practice, this weakens least-privilege enforcement and can allow broader capability use than reviewers or callers expect, especially since the workflow also handles credentials, screenshots, and external systems like Jira.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script can do more than post acceptance evidence: when --transition is supplied and --apply is used, it enumerates available Jira transitions and executes a state change on the issue. That exceeds the stated acceptance-only scope and creates a write-capable workflow control path that could be misused to advance or alter issue state without separate approval, especially if an agent is entrusted with broad Jira credentials.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The optional transition feature is not justified by the skill's declared purpose of testing and acceptance evidence posting. In an agent setting, unnecessary state-changing capabilities increase attack surface and make prompt or workflow abuse more dangerous because the same script can both publish evidence and change process status in Jira.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.