Clawhub Jira Pat Skill

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:44 PM UTC
• Version: 0.0.1

Overview

This skill is a straightforward Jira helper that uses a user-provided PAT and Jira URL, with no hidden persistence or unrelated behavior, but users should treat the URL and token as sensitive.

Install only if you need Jira PAT access for a trusted self-hosted Jira instance. Set JIRA_URL only to your approved HTTPS Jira base URL, keep the PAT short-lived and least-privileged, and avoid using this in environments where untrusted code can alter environment variables.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/jira-pat.sh:13

Finding

Jira Personal Access Token Can Be Sent to an Untrusted or Insecure Destination

Content

View full analysis

Vulnerability Details

File Location: scripts/jira-pat.sh:13-17, 21-24, 37-41, 76-84, 89-99
Vulnerability Type: Unrestricted credential destination and insecure transport
Risk Level: Medium

Vulnerable Code

bash

check_env() {
  if [[ -z "${JIRA_PAT:-}" ]]; then
    echo "Error: JIRA_PAT environment variable not set" >&2
    exit 1
  fi
  if [[ -z "${JIRA_URL:-}" ]]; then
    echo "Error: JIRA_URL environment variable not set" >&2
    exit 1
  fi
}

jira_get() {
  check_env
  local issue_key="$1"
  curl -s -H "Authorization: Bearer $JIRA_PAT" \
    "$JIRA_URL/rest/api/2/issue/$issue_key" | jq
}

jira_search() {
  check_env
  local jql="$1"
  curl -s -H "Authorization: Bearer $JIRA_PAT" \
    "$JIRA_URL/rest/api/2/search?jql=$jql" | \
    jq '.issues[] | "\(.key): \(.fields.summary) [\(.fields.status.name)]"' -r
}

curl -s -X POST \
  -H "Authorization: Bearer $JIRA_PAT" \
  -H "Content-Type: application/json" \
  -d "$payload" \
  "$JIRA_URL/rest/api/2/issue/$issue_key/transitions"

curl -s -X POST \
  -H "Authorization: Bearer $JIRA_PAT" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg body "$body" '{body: $body}')" \
  "$JIRA_URL/rest/api/2/issue/$issue_key/comment" | jq

The same unsafe pattern also appears in the documented commands in SKILL.md:20-30, 36-51, 68-69, 75-86, 92-97, 103-114, 120-133.

Technical Analysis

The helper validates only that JIRA_URL is nonempty. It does not require HTTPS, verify that the host is an approved Jira instance, or reject a URL containing an unexpected scheme, host, port, credentials, query, or fragment.

Every operation places the privileged JIRA_PAT value in an HTTP Authorization header and sends it to the origin selected through JIRA_URL. Network access and Bearer authentication are necessary for the declared Jira-management functionality, but allowing the credential destination to remain unrestricted exceeds minimum safe privilege.

If JIRA_URL is accidentally or m ...[truncated 1789 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse and validate JIRA_URL before making any request:
   • Require the https scheme.
   • Reject embedded credentials, fragments, and malformed URLs.
   • Reject unexpected ports unless explicitly approved.
   • Normalize the URL and remove trailing slashes.
2. Restrict the destination hostname through an administrator-controlled allowlist or immutable configuration. Do not rely solely on an environment variable that untrusted processes or wrappers may influence.
3. Ensure the validated origin exactly matches the origin receiving the Authorization header. Do not concatenate credentials into arbitrary user-provided URLs.
4. Preserve TLS certificate verification and do not introduce curl -k or --insecure.
5. Configure curl to fail safely and expose HTTP errors without printing credentials, for example by using --fail-with-body --silent --show-error.
6. Document that JIRA_URL is security-sensitive configuration and must come from a trusted source.
7. Use a short-lived, revocable PAT with only the Jira permissions required for the intended read or write operations.
8. Apply equivalent validation guidance to every command example in SKILL.md.

A validation routine should fail closed before any network request, for example:

bash

validate_jira_url() {
  case "$JIRA_URL" in
    https://issues.example.com|https://issues.example.com/)
      JIRA_URL="${JIRA_URL%/}"
      ;;
    *)
      echo "Error: JIRA_URL must be the approved HTTPS Jira origin" >&2
      exit 1
      ;;
  esac
}

For deployments requiring multiple Jira instances, use a securely maintained allowlist rather than accepting every HTTPS hostname.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

# Jira PAT Skill

Manage Jira issues on self-hosted/enterprise Jira instances using Personal Access Tokens (PAT). This skill is designed for environments where Basic Auth doesn't work due to SSO/SAML authentication.

## When to Use This Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

# Jira PAT Skill

Manage Jira issues on self-hosted/enterprise Jira instances using Personal Access Tokens (PAT). This skill is designed for environments where Basic Auth doesn't work due to SSO/SAML authentication.

## When to Use This Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · _meta.json (reported line 5)May include surrounding context.

json

# Jira PAT Skill

Manage Jira issues on self-hosted/enterprise Jira instances using Personal Access Tokens (PAT). This skill is designed for environments where Basic Auth doesn't work due to SSO/SAML authentication.

## When to Use This Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## Prerequisites

1. **Personal Access Token (PAT)**: Create one in Jira:
   - Go to your Jira profile → Personal Access Tokens
   - Create a new token with appropriate permissions
   - Store it in environment variable `JIRA_PAT`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/jira-pat.sh (reported line 124)May include surrounding context.

sh

## Prerequisites

1. **Personal Access Token (PAT)**: Create one in Jira:
   - Go to your Jira profile → Personal Access Tokens
   - Create a new token with appropriate permissions
   - Store it in environment variable `JIRA_PAT`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Close an issue with a comment:

bash

curl -s -X POST \
  -H "Authorization: Bearer $JIRA_PAT" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/jira-pat.sh (reported line 78)May include surrounding context.

sh

payload=$(jq -n --arg tid "$transition_id" '{transition: {id: $tid}}')
  fi

  curl -s -X POST \
    -H "Authorization: Bearer $JIRA_PAT" \
    -H "Content-Type: application/json" \
    -d "$payload" \

Static analysis

No suspicious patterns detected.