Security audit

Jiraandconfluence Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Jira and Confluence purpose is clear, but its helper scripts handle credentials in a way that can unexpectedly execute a local file and expose tokens to local process inspection.

Review before installing. Use least-privilege read-only Atlassian tokens, run the scripts only from a trusted directory, and avoid any environment where another user or monitoring system can inspect process command lines. The publisher should anchor auth.sh to the script directory and use a safer secret-passing mechanism for curl before this is treated as low risk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/jira_reader.sh:5
Finding: Working-Directory-Dependent Sourcing Allows Arbitrary Code Execution in Jira Reader
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi source "$AUTH_FILE" ``` Additionally: - Ensure the installation directory and `auth.sh` are owned by a trusted account and are not writable by untrusted users. - Fail closed when the expected authentication script is missing. - Validate arguments before performing operations that are not required for argument handling. - Consider eliminating executable configuration sourcing entirely; use a non-executable configuration format if only data must be loaded. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/confluence_reader.sh:5
Finding: Working-Directory-Dependent Sourcing Allows Arbitrary Code Execution in Confluence Reader
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi source "$AUTH_FILE" ``` Further hardening should include: - Restricting write permissions on the script installation directory. - Verifying that deployment does not permit untrusted users to replace `auth.sh`. - Avoiding executable configuration files where a data-only configuration mechanism is sufficient. - Validating command-line arguments before unnecessary initialization. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/jira_reader.sh:20
Finding: Jira API Credential Exposed Through Curl Process Arguments
Content: View full analysis
Remediation: View remediation
"$CURL_CONFIG" printf 'header = "Content-Type: application/json"\n' >> "$CURL_CONFIG" curl --silent --show-error --fail \ --config "$CURL_CONFIG" \ "$JIRA_API_URL" | jq '.' ``` Also enforce least-privilege Jira permissions, rotate exposed tokens, avoid verbose shell tracing, and configure host process visibility so unrelated users cannot inspect process metadata. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/confluence_reader.sh:20
Finding: Confluence API Credential Exposed Through Curl Process Arguments
Content: View full analysis
Remediation: View remediation
"$CURL_CONFIG" printf 'header = "Content-Type: application/json"\n' >> "$CURL_CONFIG" curl --silent --show-error --fail \ --config "$CURL_CONFIG" \ "$CONFLUENCE_API_URL" | jq '.' ``` Additional controls should include: - Restricting the token to read-only, least-privilege access. - Rotating credentials suspected of prior exposure. - Disabling shell tracing around secret-handling code. - Restricting cross-user process inspection and protecting monitoring logs. - Ensuring temporary files are never created with permissive default access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script performs an HTTP request to Confluence and includes an Authorization header populated from CONFLUENCE_API_TOKEN. While the code comments mention authentication, there is no user-facing warning, confirmation, or explicit disclosure that credentials and requested page data will be sent over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs a network request to Jira and sends an authorization token in the request headers, but there is no user-facing disclosure beyond an internal comment. The script prints usage information only and does not warn that it will contact an external service using configured credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.