Security audit

jira-issue-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This Jira helper is broadly purpose-aligned, but it handles Jira tokens and attachments in ways that could leak credentials or overwrite local files.

Install only after reviewing the Jira host and token handling. Use HTTPS, prefer a narrowly scoped read-only Jira token, avoid downloading attachments from untrusted issues, and verify download/report paths before allowing writes or cleanup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: jira/README.md:18
Finding: Jira Bearer Token Is Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: jira/jira_client.py:148
Finding: Bearer Token Can Be Forwarded to an Unrestricted Attachment URL
Content: View full analysis
str: import os os.makedirs(dest_dir, exist_ok=True) filepath = os.path.join(dest_dir, filename) response = self.session.get(content_url, stream=True) response.raise_for_status() with open(filepath, 'wb') as f: for chunk in response.iter_content(chunk_size=8192): f.write(chunk) ``` The unvalidated metadata value reaches the request at `jira/jira_client.py:166-170`: ```python filepath = self.download_attachment( att['content'], att['filename'], dest_dir ) ``` ### Technical Analysis `self.session` contains a global bearer authorization header. `download_attachment()` accepts an arbitrary absolute URL and sends the request through that authenticated session without validating its scheme, hostname, or port. The attachment URL is obtained from server-controlled API data. A compromised Jira instance, manipulated plaintext response, malicious test endpoint, or other server-side metadata modification can therefore direct the client to an unrelated external host or an internal service ...[truncated 1610 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: jira/jira_client.py:148
Finding: Untrusted Attachment Filename Permits Writes Outside the Download Directory
Content: View full analysis
str: import os os.makedirs(dest_dir, exist_ok=True) filepath = os.path.join(dest_dir, filename) response = self.session.get(content_url, stream=True) response.raise_for_status() with open(filepath, 'wb') as f: for chunk in response.iter_content(chunk_size=8192): f.write(chunk) ``` The filename comes from Jira-controlled attachment metadata at `jira/jira_client.py:128-138`: ```python 'attachments': [ { 'id': a.get('id'), 'filename': a.get('filename'), 'size': a.get('size'), 'mimeType': a.get('mimeType'), 'content': a.get('content'), 'author': a.get('author', {}).get('displayName', ''), 'created': a.get('created'), } for a in fields.get('attachment', []) ], ``` ### Technical Analysis The attachment filename is passed directly to `os.path.join(dest_dir, filename)`. There is no rejection of absolute paths, parent-directory components, platform-specific separators, or other unsafe path forms. A name such as `../../target-file` can resolve outside the intended attachment directory. An absolute filename can cause `os.path.join()` to disregard the destination directory entirely. The target is then opened using `wb`, which truncates and overwrites an existing file. There is also no canonical-path containment check or protection against symlink targets. The write occurs with all filesystem permissions of the process running the Skill. ### Attack Path 1. An attacker creates or influences a Jira attachment with a traversal or absolute filename. 2. A user asks the Skill to download attachments from the affected issue. 3. Jira returns the crafted filename in attachment ...[truncated 904 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: jira/unzip_attachment.py:14
Finding: Unbounded ZIP Extraction Enables Resource-Exhaustion Attacks
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: jira/requirements.txt:1
Finding: Open-Ended Dependency Versions Make Installation Non-Reproducible
Content: View full analysis
=2.28.0 python-dotenv>=1.0.0 ``` The packages are installed as part of the mandatory initialization process documented in `SKILL.md:12-15`: ```bash cd ~/.cursor/skills/jira-issue-analyzer/jira python3 -m venv .venv .venv/bin/python -m pip install -r requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. The versions installed during one review may therefore differ from versions installed later. No package hashes or lock file are provided, and the installation command relies on the user's configured package index. There is no evidence that the named packages are malicious or typosquatted. The risk arises from non-reproducible resolution: a compromised, malicious, or incompatible future release satisfying the version constraint could be installed without any change to the reviewed Skill package. ### Attack Path 1. A user follows the mandatory environment-initialization instructions. 2. pip queries the configured package index. 3. pip selects the latest package versions satisfying the open-ended constraints. 4. A compromised or otherwise unsafe matching release is downloaded. 5. Package installation or later import executes code from that release in the user's environment. ### Impact Assessment A malicious dependency release would execute with the privileges of the user creating or running the virtual environment. It could access the Jira token from environment variables or `.env`, read Jira data handled by the Skill, alter local files, or perform network operations. This is a supply-chain hardening issue rather than evidence that the currently named dependencies are malicious. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code chunk is specifically a low-level Jira client, not the described analysis orchestrator. It does align partially with the description in that it can retrieve issue details and download attachments, but the declared primary purpose includes coordinating analysis, delegating log analysis to a subagent, and producing a final Markdown report to a local directory—none of which appear in this code. Additionally, the code includes undeclared capabilities such as testing Jira connectivity and searching issues by JQL/assignee. These are not harmful by themselves, but they are materially different from the declared role of an orchestrator. Therefore this chunk does not accurately represent the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 描述将该技能定位为“问题分析编排器”，核心输出应是分析文档/Markdown 报告，并包含附件获取后进一步委托日志分析的流程。但代码仅实现了 Jira 数据获取与展示/下载：get 获取单个 issue 并打印详情或 JSON，download 下载附件，list 按 assignee 列出问题，--test 测试连接。代码中没有任何 Markdown 文件写入逻辑、没有本地报告生成、没有 subagent/日志分析调用或编排流程。因此其主要用途与声明存在实质性偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a higher-level Jira analysis workflow: obtaining issue data and attachments, orchestrating analysis, and producing a Markdown report. The supplied code does none of those tasks. It only unzips a hardcoded local attachment file into a local folder and lists extracted files. While attachment extraction could be a supporting step in a larger Jira workflow, this code chunk by itself lacks the core declared behaviors and instead has a materially narrower and different primary function.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · jira/README.md (reported line 15)May include surrounding context.
cd ~/.cursor/skills/jira-issue-analyzer/jira python3 -m venv .venv .venv/bin/python -m pip install -r requirements.txt cp .env.example .env

text
编辑 `.env`：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · jira/config.py (reported line 6)May include surrounding context.
python
import os from dotenv import load_dotenv # Load environment variables from .env file load_dotenv()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · jira/main.py (reported line 213)May include surrounding context.
python
import os from dotenv import load_dotenv # Load environment variables from .env file load_dotenv()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · jira/main.py (reported line 214)May include surrounding context.
python
import os from dotenv import load_dotenv # Load environment variables from .env file load_dotenv()

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents all user-facing documentation in Chinese, including headings and package descriptions, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, a skill that effectively mandates a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of networked Jira access and environment-based secrets (JIRA_TOKEN) but does not declare any explicit tool scope or allowed-tools boundaries. This weakens least-privilege controls and makes it easier for an agent to use broader-than-necessary capabilities when handling potentially sensitive Jira data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language content of the skill, including its description and operational steps, is presented in Chinese only. There is no indication that the user can choose another language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs deletion of a temporary attachment directory after report generation without an explicit safety warning or confirmation step. File deletion is destructive, and if the path is wrong, templated incorrectly, or manipulated, data loss could occur outside the intended temporary area.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description and instructions are entirely in Chinese and present the role as a Chinese-language Jira log analyst, but nowhere offers the user a language choice or states that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README content is written entirely in Chinese, including usage instructions, with no indication that other languages are supported or that the Chinese-only requirement is intentional and justified. Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The client returns assignee email addresses in issue listings even though the stated skill purpose is Jira issue analysis/report generation, not contact harvesting or identity enrichment. Exposing unnecessary personal data increases privacy risk, broadens downstream data propagation into reports/logs, and can leak employee contact information to components that do not need it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Detailed issue retrieval includes both assignee and reporter email addresses, which are not necessary for analyzing issue content, attachments, or comments. In this skill context, those fields are likely to be copied into generated Markdown or passed to subagents, unnecessarily spreading personal data and increasing privacy/compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Attachment downloads write untrusted Jira-provided filenames directly to disk without user confirmation or filename sanitization. A malicious attachment name could perform path traversal and overwrite files outside the intended directory, and the silent write behavior makes this more dangerous in an agent workflow that automatically fetches external content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing output strings in the detailed issue view are written in Chinese, including section headers and field labels, with no visible option for users to select another language. This creates a language/locale policy concern because the skill effectively forces a specific language without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill focused on orchestrating Jira issue analysis, fetching issues and attachments, delegating log analysis to a subagent, and outputting a final Markdown report to a local directory. This file instead exposes CLI commands for fetching a single issue, downloading attachments, listing issues by assignee, and testing connectivity, with output limited to stdout JSON/detail/table views and attachment downloads; there is no orchestration, subagent delegation, or Markdown report generation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The list command allows enumeration of issues for an arbitrary assignee, which expands access beyond the stated purpose of analyzing a user-requested Jira issue. In an agent context, this broadens data exposure and could be abused to collect metadata, comments, and issue contents for many tickets unrelated to the user's task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs the agent to write a Markdown report into a local project directory without explicit user notice about persistent local writes. This can surprise users, expose sensitive Jira-derived information in the workspace, and create unintended retention of potentially confidential issue data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly requires writing a Markdown report into a local project directory, but it does not require user confirmation or present any warning that it will modify the filesystem. In an agent setting, silent local writes can violate user expectations, overwrite existing artifacts, or be chained with broader orchestration to create unintended persistence in the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file states that the skill can query Jira issues and download attachments, which may involve retrieving potentially sensitive issue data and writing files locally. The description provides usage examples but does not include any warning about handling confidential attachment contents or where files will be stored.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The module docstring says 'Main entry point for Jira issue fetcher' and the CLI parser description is 'Jira issue fetcher', framing the tool as a retrieval utility. That documented intent conflicts with the manifest's claim that the skill is an analysis orchestrator that delegates log analysis and produces a final Markdown report.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower bound only, which allows installation of many different versions over time and makes builds non-reproducible. In a security-sensitive skill that fetches Jira issues and attachments over the network, this increases supply-chain risk because a vulnerable or unexpected requests release could be resolved without review.
Content: Scanner excerpt · jira/requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0 python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest does not pin requests, and requests has multiple known advisories across versions, so it is impossible to verify from this file whether deployment will install a safe release. Given this skill likely makes outbound HTTP requests to Jira and may handle credentials, unresolved requests version risk is more relevant than in an offline-only utility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.