Security audit

Jira Access

Security checks across malware telemetry and agentic risk

Overview

This Jira skill needs Review because it points users to a specific Atlassian tenant and email, asks for Jira API credentials, and can change live Jira issues without confirmation safeguards.

Install only if you intentionally want this agent to use that specific Jira workspace, or edit it first to use your own tenant and account. Use a dedicated low-permission Jira API token, avoid copying secrets into shell history or committed files, and require explicit approval before creating issues, changing statuses, or posting comments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The documentation says secrets should not be stored in source control, but then includes a concrete email address and an API token value pattern in the file itself. Even if presented as an example or truncated token, this normalizes secret disclosure, may expose a real credential fragment, and encourages unsafe copy/paste handling of sensitive authentication material.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script exposes a comment operation that is not disclosed in the skill metadata, creating a capability mismatch between what users/reviewers expect and what the skill can actually do. Hidden or undocumented write actions are dangerous because they expand the action surface and can be invoked to modify external systems in ways that bypass user understanding, approval, or policy review.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger condition says to activate on any request that mentions Jira operations, which is overly broad for a skill that can read and modify issues. Over-broad triggering increases the chance of unintended invocation and accidental issue creation, comments, or transitions based on ambiguous user language.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises create, transition, comment, and attachment capabilities without clearly warning that these are data-changing operations in a live Jira workspace. In this context, lack of warning is risky because the skill targets a real tenant and authenticated API access, so users may not realize a natural-language request can mutate production project data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The create, transition, and comment commands perform immediate state-changing actions against a live Jira instance without any built-in confirmation, dry-run mode, or user-visible warning. In an agent setting, this increases the risk of prompt-induced or accidental remote modifications such as creating spam issues, altering workflow state, or posting unintended comments to production tickets.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.