Jira BUG Analysis Assistant[Jira-BUG分析助手]

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.1

Overview

This Jira reporting skill appears legitimate, but it needs review because it handles Jira credentials and creates portable raw-data exports without enough safeguards.

Review before installing. Use a short-lived, read-only Jira PAT scoped to the specific project; avoid username/password auth; do not use --no-verify or curl -k unless you fully accept interception risk; treat generated HTML and XLS files as sensitive internal exports; and install dependencies in an isolated environment with pinned versions if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/get_jiraData.py:121

Finding

TLS Certificate Verification Can Be Disabled for Authenticated Jira Requests

Content

View full analysis

: -k /rest/api/2/project/ | python3 -c "import sys,json;[print(t['name']) for t in json.load(sys.stdin).get('issueTypes',[])]" ``` ### Technical Analysis When `--no-verify` is supplied, `requests` no longer authenticates the Jira server's TLS certificate. The documented `curl -k` command has the same effect. Disabling warning messages further reduces the likelihood that the user will notice the connection is unauthenticated. The session sends either a bearer token or Basic Authentication credentials over this connection. TLS encryption without certificate validation does not establish the identity of the remote server, so an active network attacker can present an arbitrary certificate and impersonate Jira. Supporting private certificate a ...[truncated 1672 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_jiraData.py:71

Finding

Jira Credentials Are Accepted Through Process Command-Line Arguments

Content

View full analysis

\ --token \ --project \ [--issue-type Bug] \ [--start-date YYYY-MM-DD] \ [--end-date YYYY-MM-DD] \ [--severity-field customfield_NNNNN] \ [--no-verify] ``` For Basic Authentication, the instructions state that the token should be replaced with: ```bash --username --password ``` ### Technical Analysis Command-line arguments are an unsafe channel for reusable secrets. Depending on the operating system and execution environment, arguments may be visible in process inspection interfaces, monitoring agents, shell history, terminal logs, job metadata, agent transcripts, crash reports, or command audit records. The code does not log the parsed secret itself, but that does not prevent exposure by the shell, process supervisor, or surrounding automation before Python processes the arguments. The risk is particularly significant for a Skill operated by an AI agent because generated commands and execution transcripts may be retained. ### Attack Path 1. A user follows the documented invocation and supplies a PAT or password as a command-line argument. 2. The shell records the command in histor ...[truncated 856 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Python Dependency Is Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_jiraData.py:104

Finding

Untrusted Project and Issue-Type Values Are Interpolated into JQL

Content

View full analysis

= "{start_date}"' if end_date: jql += f' AND created <= "{end_date}"' jql += " ORDER BY created DESC" return jql ``` These values originate from command-line arguments: ```python parser.add_argument("--project", required=True, help="Jira project key, e.g. PROJ") parser.add_argument( "--issue-type", default="Bug", help="Issue type name to query (default: Bug). Use '故障' for Chinese Jira instances." ) ``` ### Technical Analysis The `project` and `issue_type` values are inserted directly into a JQL expression without validation, quoting, or escaping. An attacker who can influence Skill arguments can provide JQL operators, clauses, or delimiters that alter the intended query. Date values are format-validated before use, but equivalent validation is not applied to the project key or issue-type name. The vulnerable query is sent to Jira using the invoking user's credentials. Jira authorization still limits which issues can be returned, but the injection can broaden retrieval beyond the project or issue type requested by the user. ### Attack Path 1. An attacker controls or influences the `--project` or `--issue-type` value passed to the Skill. 2. The attacker supplies a value containing additional JQL syntax that changes the query's logical structure. 3. `build_jql()` concatenates the value into the query without validation or escaping. 4. The script submits the altered query to `/rest/api/2/search`. 5. Jira returns any matching issues that the authenticated account is authorized to view. 6. The script exports the ...[truncated 808 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

代码与描述部分重合：它确实连接 Jira Server/DC、查询 Bug、并计算趋势/分布/解决时间/老化等统计维度。但声明强调的是一个端到端技能：拉取数据后进行全面 AI 分析并生成交互式 HTML 报表。给出的实际代码仅实现了数据获取、字段提取和聚合统计的后端数据准备步骤，没有任何 AI 推理、报告撰写、HTML/SVG 生成、交互式前端输出等逻辑。因此这是功能范围上的明显不一致。未声明的危险或无关资源访问未见明显存在；主要问题是声明的核心后续能力没有在代码中体现。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly asks for PATs or username/password credentials as conversational inputs. Collecting credentials in-band through the agent is dangerous because secrets may be exposed in chat history, logs, prompts, or downstream tool invocations, and password-based auth is especially risky.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

**必填参数：**
- **Jira Server URL**: 例如 `https://jira.company.com`
- **认证方式**（二选一）：
  - Personal Access Token (PAT)（推荐）
  - 用户名 + 密码
- **Project Key**: Jira 项目标识，例如 `PROJ`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill instructs a credentialed curl request to a user-supplied server and pipes the response into Python for processing. This is dangerous because it combines external network access, secret use, SSL bypass capability, and command composition around untrusted parameters, increasing the risk of SSRF, secret exposure, and unsafe handling of remote content.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Issue Type 自动检测：如果脚本返回 0 条数据，可能是 Issue Type 名称不匹配。此时应通过 REST API 查询项目实际的 Issue Type 列表：

bash

curl -u <USER>:<PASS> -k <SERVER>/rest/api/2/project/<PROJECT_KEY> | python3 -c "import sys,json;[print(t['name']) for t in json.load(sys.stdin).get('issueTypes',[])]"

如果发现实际名称为中文（如 故障、缺陷），用 --issue-type 参数指定后重新执行。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The use of curl -u <USER>:<PASS> -k <SERVER> encourages insecure tool parameters: credentials on the command line and disabled certificate verification. In context, this makes credential theft and man-in-the-middle interception substantially more likely, especially on shared systems where process arguments may be observable.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Issue Type 自动检测：如果脚本返回 0 条数据，可能是 Issue Type 名称不匹配。此时应通过 REST API 查询项目实际的 Issue Type 列表：

bash

curl -u <USER>:<PASS> -k <SERVER>/rest/api/2/project/<PROJECT_KEY> | python3 -c "import sys,json;[print(t['name']) for t in json.load(sys.stdin).get('issueTypes',[])]"

如果发现实际名称为中文（如 故障、缺陷），用 --issue-type 参数指定后重新执行。

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requires embedding the complete raw Jira JSON into the generated HTML and does not warn the user that the report will contain all retrieved issue data. That can expose internal bug descriptions, assignees, labels, versions, and other metadata to anyone who opens, shares, or stores the report, turning a visualization artifact into a bulk data disclosure vehicle.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to generate a downloadable Excel file containing all raw issue records creates an explicit bulk-export mechanism for sensitive Jira data. This greatly lowers the barrier to exfiltration because a single click produces a portable spreadsheet with detailed issue metadata that can be redistributed outside Jira's access controls.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_jiraData.py (reported line 73)May include surrounding context.

python

description="Fetch bug data from Jira Server/DC and output structured JSON."
    )
    parser.add_argument("--server", required=True, help="Jira base URL, e.g. https://jira.company.com")
    parser.add_argument("--token", help="Personal Access Token (Bearer auth)")
    parser.add_argument("--username", help="Basic Auth username")
    parser.add_argument("--password", help="Basic Auth password")
    parser.add_argument("--project", required=True, help="Jira project key, e.g. PROJ")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill performs network-capable actions against Jira and instructs credentialed access, but it declares no explicit tool scope or allowed-tools boundary. That increases the chance of unintended tool use or overbroad execution in an agent runtime, especially because the skill also includes follow-on shell commands and API calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill when the user wants to 'analyze Jira bugs, generate bug reports, or view bug metrics,' but it does not define clear boundaries or exclusion conditions. Phrases like '生成 Bug 报表' and especially '查看 Bug 指标' are broad enough to overlap with many general analytics or reporting requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs collection of Jira credentials and issue data without any explicit warning about handling secrets or potentially sensitive project content. This is dangerous because users may provide PATs, usernames, passwords, and internal defect data directly to the agent without being told about exposure, retention, or safer alternatives.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Embedding the full Jira output into client-side HTML materially increases the blast radius of any sensitive data retrieved from Jira. Because the page is self-contained and portable, it is easy to email, upload, or open on unmanaged devices, causing broad disclosure of internal project and personnel data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script accepts any server URL and does not enforce HTTPS or warn when plain HTTP is used. If a user supplies an insecure URL, Jira credentials, query contents, and returned issue data can be exposed to interception or tampering in transit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The --no-verify option disables TLS certificate validation and only suppresses warnings, which enables man-in-the-middle attacks against both credentials and Jira data. This is especially risky for an enterprise Jira analysis skill because it routinely handles potentially sensitive bug details and authentication secrets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script outputs the full per-issue dataset, including summaries, assignees, reporters, labels, and other ticket metadata, not just aggregated statistics. In a skill whose stated purpose is analysis/report generation, this materially increases data exposure and makes it easier for downstream components or users to exfiltrate sensitive operational or personal information from Jira.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The instructions explicitly anticipate Chinese issue type names such as '故障' and '缺陷' and direct behavior around them, but do not offer a general language or locale choice for users. While not severe, this reflects a language-specific assumption in natural-language guidance without explicit opt-in or broader locale framing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency manifest specifies requests without a version pin, which makes builds non-reproducible and can silently introduce vulnerable or incompatible releases over time. In a skill that pulls Jira bug data from a server and may handle authenticated requests, dependency drift increases supply-chain risk and makes it impossible to verify whether known vulnerable versions are in use.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

requests has multiple published advisories, and because no version is pinned, the actual installed version cannot be verified as patched. This skill's purpose—retrieving Jira Server/DC bug data—likely involves authenticated HTTP requests to internal systems, so using an affected requests release could expose credentials, session data, or permit other request-handling weaknesses depending on the deployed version.

Content

No source excerpt is available for this finding.