Jiraandconfluence Skill

• Analyzed: May 11, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.0
• Hash: 657b87cb3052d4a7d195e5539301d38602e1e4ccb059dad32f77a738593eae2c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to potential URL injection vulnerabilities in `scripts/confluence_reader.sh` and `scripts/jira_reader.sh`. User-supplied arguments (`$1`) are directly interpolated into the `curl` API endpoint URLs without proper encoding, which could allow an attacker to manipulate the API requests (e.g., path traversal, query parameter injection) made by the agent to Jira or Confluence. Additionally, `scripts/auth.sh` contains a syntax error (missing double quotes) that would prevent it from executing correctly, leading to authentication failures. There is no evidence of malicious intent or prompt injection against the AI agent.