T09 · Insecure Skill Coding Practices
Error
- Location
scripts/jira_cli.py:18- Finding
Jira credentials can be transmitted to an attacker-controlled host
- Content
View full analysis
- Remediation
View remediation
Security audit
Jira Access
Security checks for vulnerabilities and agentic risk
Overview
This Jira skill mostly matches its stated purpose, but it needs review because it can change live Jira data and sends the Jira API token to the configured domain without validating it.
Install only if you trust the publisher and can tightly control the runtime environment. Set JIRA_DOMAIN only to the intended Atlassian tenant, use a least-privileged Jira API token, rotate any token that may have run with an untrusted domain, and require explicit user approval before create, transition, or comment commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:33- Finding
Unpinned third-party dependency installation creates supply-chain exposure
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 3. Install with hash enforcement: ```powershell python -m pip install --require-hashes -r requirements.txt ``` 4. Pin all transitive dependencies or use a lock-file tool that records the complete resolved dependency graph. 5. Install only from an explicitly trusted package index and prevent fallback to untrusted extra indexes. 6. Review dependency updates before modifying the lock file and use automated vulnerability and provenance scanning. 7. Perform installation in an isolated virtual environment with minimal privileges. 8. Avoid exposing Jira credentials during dependency installation; supply them only when the reviewed application is executed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires access to environment variables and the network, but it does not declare any explicit tool scope or allowed-tools boundary. In a credentialed Jira integration, this weakens least-privilege controls and can allow broader-than-expected execution or secret access if the runtime grants defaults.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger text says to activate on any request that mentions Jira operations, which is overly broad for a skill that can both read and modify issue data. Over-triggering can cause the assistant to invoke this skill in ambiguous contexts and perform unintended actions against a live Jira tenant using stored credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description emphasizes operational capabilities but does not clearly warn that it can modify Jira data. In practice, this can lead users or orchestrators to treat the skill as informational when it is capable of creating issues, transitioning workflow state, and adding comments or attachments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code implements a comment operation that is not disclosed in the skill metadata, creating a capability mismatch between what reviewers/users expect and what the tool can actually do. Hidden write capabilities are dangerous in agentic settings because they expand the action surface beyond the declared scope and could be invoked without appropriate policy, review, or user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The create, transition, and comment commands directly perform state-changing requests against a live Jira instance with no built-in confirmation, dry-run mode, or user-approval checkpoint. In an agent context, this raises the risk of accidental or prompt-induced remote modifications, especially since the skill is designed to trigger broadly on Jira-related requests.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description limits the skill to listing, creating, and transitioning Jira issues, but the SKILL.md overview and usage also describe adding comments and attachments. That expands the described behavior beyond the manifest’s stated scope, even though it remains within Jira.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
The documentation states 'Ensure Python 3.9+ is installed on Windows' and labels PowerShell as recommended, which imposes a specific platform context without indicating whether alternatives are supported. This is a mild natural-language policy concern because it constrains usage without explicit opt-in or justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The parser exposes a comment subcommand while the surrounding skill description says to use the skill for Jira operations but does not mention commenting. This inconsistency can cause downstream tooling or reviewers to under-classify the skill's write capabilities, making unauthorized or unexpected comments more likely in practice.
- Content