Clawhub Jira Pat Skill

• Analyzed: May 12, 2026, 3:41 AM
• Findings: 1
• Version: 0.0.1
• Hash: 870f8c53006aa082056f6aae9c4449c2483c2468da483584925e762a27ac6baf
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for Jira management using Personal Access Tokens. While the `SKILL.md` provides legitimate instructions, the `scripts/jira-pat.sh` helper script contains multiple shell injection vulnerabilities. User-supplied arguments (e.g., issue keys, JQL queries) are directly interpolated into `curl` command URLs without proper sanitization, allowing for arbitrary command execution if an attacker can control the input to these functions. This is a critical vulnerability, but there is no evidence of intentional malicious behavior like data exfiltration or backdoor installation, thus classifying it as suspicious.