Jira

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If approved or used carelessly, broad Jira API calls could change issues, projects, or workflow state.

Why it was flagged

The skill exposes a broad Jira native-API proxy rather than only narrowly scoped helper commands. This is useful for a Jira API skill, but it means the agent could reach many Jira REST endpoints within the connected account.

Skill content

https://api.maton.ai/jira/{native-api-path}

Recommendation

Use explicit user approval for all writes, prefer specific Jira commands when possible, and review raw API paths before execution.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may access or modify Jira data allowed by the connected account and OAuth scopes.

Why it was flagged

The skill requires delegated Jira access and can perform account actions. This is expected for a Jira integration, but it is sensitive authority.

Skill content

Access the Jira Cloud API with managed OAuth authentication. Search issues with JQL, create and manage issues, and automate workflows.

Recommendation

Connect only the intended Jira account, use least-privileged permissions where possible, specify the intended cloud ID/connection, and revoke connections when no longer needed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing an external CLI adds code from outside this skill package to the user's environment.

Why it was flagged

The instruction-only skill documents optional installation of an external CLI package/tap. The commands are user-directed setup, not automatic execution, but users should verify the package source.

Skill content

npm install -g @maton-ai/cli ... brew install maton-ai/cli/maton

Recommendation

Install the Maton CLI only from a trusted source, verify the package/tap, and keep it updated.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Jira data and actions pass through Maton's API service before reaching Atlassian.

Why it was flagged

Jira API traffic and OAuth-backed authorization flow through the Maton gateway. This is disclosed and central to the skill, but it requires trusting that provider with Jira requests and authorization handling.

Skill content

Maton proxies requests to `api.atlassian.com` and automatically injects your OAuth token.

Recommendation

Use this skill only if you trust Maton's OAuth proxy, protect MATON_API_KEY, and avoid sharing generated OAuth/session URLs.