Security audit

YouTrack Project Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent YouTrack integration, but it handles a permanent API token and sensitive project data with weak destination checks and under-disclosed invoice data exposure.

Review this before installing. Use only a least-privilege YouTrack token, store it in a protected environment variable or secret manager, avoid the --token argument, and verify the URL is your HTTPS YouTrack host before running. Treat generated invoices as sensitive because they may include internal issue descriptions, author names, and work-log details; redact before sharing externally.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/youtrack_api.py:26
Finding: Permanent API Token Can Be Sent to an Arbitrary or Plaintext Origin
Content: View full analysis
Dict[str, Any]: """ Make an authenticated API request. Args: method: HTTP method (GET, POST, PUT, DELETE) endpoint: API endpoint (e.g., '/api/issues') data: Request body for POST/PUT Returns: Parsed JSON response """ url = urljoin(self.base_url, endpoint) req_data = None if data is not None: req_data = json.dumps(data).encode('utf-8') req = urllib.request.Request( url, data=req_data, headers=self.headers, method=method ) ``` ### Technical Analysis The caller supplies `base_url`, but the client does not validate its scheme, hostname, port, or relationship to an approved YouTrack instance. Every request generated by the client automatically receives the permanent bearer token through the shared `Authorization` header. If an `http://` URL is supplied, the token and associated request d ...[truncated 1797 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:71
Finding: Command-Line Token Option Can Expose Permanent Credentials
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/invoice_generator.py:45
Finding: Invoice Generation Retrieves and Emits More Project Data Than Required
Content: View full analysis
List[Dict]: """ Get issues, optionally filtered by a query. Args: query: YouTrack query language (e.g., 'project: MyProject') fields: Comma-separated list of fields to return Returns: List of issues """ params = {'fields': fields} if query: params['query'] = query # Build query string query_string = '&'.join(f'{k}={urllib.parse.quote(str(v))}' for k, v in params.items()) endpoint = f'/api/issues?{query_string}' result = self._make_request('GET', endpoint) return result if isinstance(result, list) else [] def get_issue(self, issue_id: str) -> Dict: """Get a specific issue by ID.""" return self._make_request('GET', f'/api/issues/{issue_id}') ``` Work-item retrieval requests author names and work-item text even though cost calculation only uses duration: ```python def get_work_items(self, issue_id: str) -> List[Dict]: """Get all work items (time entries) for an issue.""" result = self._make_request('GET', f'/api/issues/{issue_id}/timeTracking/workItems?fields=id,date,duration(minutes),author(name),text') # Convert date from milliseconds to ISO format for wi in result: if 'date' in wi and wi['date']: wi['date'] = datetime.fromtimestamp(wi['date'] / 1000).isoformat() return result if isinstance(result, list) else [] ``` The invoice workflow retains those fields: ```python issues = self.api.get_issues(query=query) proj ...[truncated 3646 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims invoice-generation capabilities, including billing logic and client-facing export workflows, but the analyzed content provides only documentation and no implementation evidence for those functions. This mismatch is dangerous because users may authorize sensitive project/time-tracking access under false assumptions about what the skill does, reducing auditability and increasing the chance of unsafe substitute behavior or later hidden implementation drift.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly instructs users to use a permanent API token for authentication but does not include any warning about treating the token as a secret, avoiding logging or embedding it in files, or preferring least-privilege and rotation practices. In a skill that interacts with projects, issues, work items, and knowledge base content, a leaked long-lived bearer token could enable unauthorized reading and modification of sensitive operational data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents use of environment variables for a permanent API token and network access to a remote YouTrack instance, but the manifest does not declare any tool scope or permissions. This creates a trust and containment gap: an agent or reviewer cannot reliably infer that the skill will access secrets and external services before use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The documentation instructs users to generate invoice text from time-tracking data and save it for client distribution, but it does not warn that exported artifacts may contain sensitive employee, project, or work-log details. In this context, the skill processes operational and billing data, so omission of privacy guidance increases the risk of accidental data leakage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.