Security audit

junie

Security checks for vulnerabilities and agentic risk

Overview

This Junie helper appears coherent and not malicious, but it should be reviewed because installation can run unverified external code and persist agent configuration.

Install only if you trust JetBrains Junie and are comfortable with external installer/package-manager code running as your user. Prefer a reviewed or pinned install path where available, inspect config changes before writing ~/.junie or project .junie files, keep API keys in environment variables instead of durable config unless you explicitly want persistence, and confirm which model/provider will receive repository context before launching Junie tasks.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install_junie.sh:94
Finding: Unverified Remote Installer Download and Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install_junie.sh:108
Finding: Unpinned Global Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
` rather than resolving the latest release. 3. Verify registry provenance, publisher identity, package integrity metadata, and signatures where the package ecosystem supports them. 4. Pin the Homebrew tap or formula to a reviewed release where practical, and report the exact resolved formula version and source. 5. Require user confirmation before global package installation or automatic upgrades. 6. Prefer an isolated or project-local npm installation when global command availability is not required. 7. After installation, report and validate the resolved version and executable path. 8. Avoid automatically upgrading an existing installation as a fallback for a failed install; distinguish “already installed” from genuine installation failures. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code is aligned with only a narrow subset of the description: installing/reinstalling Junie CLI, with some update-like behavior via brew upgrade and version reporting. The declared purpose, however, presents a substantially broader skill centered on full Junie lifecycle management and orchestration, including authentication, configuration management, bootstrap of repo layouts, CI/headless setup, and specific command-phrase-triggered interactions. None of those broader behaviors appear in the supplied code chunk. This is a description-versus-behavior mismatch because the actual code implements only installation logic rather than the wider native Junie steering/setup functionality described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents a broad Junie CLI setup and orchestration skill, focused on installation, authentication, configuration, bootstrapping, CI/headless preparation, and directing Junie execution. The actual code does none of those things. Instead, it is a standalone analytics utility for reading local Junie session logs and summarizing observed usage and cost. This is a materially different primary purpose and introduces an undeclared capability: inspection of local session log/state files under ~/.junie/sessions. While both relate to Junie, the implemented behavior is usage-reporting/telemetry analysis rather than CLI management or control. Therefore the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill encourages selecting external models/providers and exporting provider API keys for use with Junie. This creates a real data-exfiltration and policy-bypass risk because repository contents or prompts may be sent to third-party model providers, and the skill is specifically designed to steer another agent to perform implementation and review tasks over local code.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
bash
export JUNIE_OPENAI_API_KEY='...' junie --model gpt-5 "review the latest changes" export JUNIE_ANTHROPIC_API_KEY='...' junie --model sonnet "review the latest changes"

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: curl -fsSL https://junie.jetbrains.com/install.sh | bash is a classic external-script-fetch pattern that grants immediate shell execution to remote content. Because this skill is specifically intended to steer host agents through installation and configuration, the context makes it more dangerous: an automated agent may execute the command without scrutiny, turning any upstream compromise into arbitrary code execution on the target machine.
Content: Scanner excerpt · references/junie-doc-notes.md (reported line 8)May include surrounding context.
md
## Install Documented install methods: - macOS/Linux: `curl -fsSL https://junie.jetbrains.com/install.sh | bash` - Windows PowerShell: `powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (irm 'https://junie.jetbrains.com/install.ps1')"` - macOS Homebrew: `brew tap jetbrains/junie && brew update && brew install junie` - npm: `npm install -g @jetbrains/junie`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to perform shell execution, file reads, and file writes, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That makes the skill over-privileged by default and increases the chance that a host agent invokes filesystem or shell actions broader than the user intended, especially because the skill includes installation, config mutation, and bootstrap flows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill directs persistent modification of ~/.junie/config.json and project .junie/config.json and bootstraps repo-local Junie state. Persistent changes can outlive the current task, alter future agent behavior, and introduce hidden trust boundaries through skill/model/MCP/rules wiring, making this more dangerous than an ephemeral one-shot command.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: junie description: Install, update, authenticate, configure, and direct JetBrains Junie CLI in Junie-native ways on macOS or Linux shells. Use when a host agent should steer Junie iteratively toward an overall goal, especially when the host agent has broader context than Junie, Junie should carry out focused implementation/review work, or the task may benefit from Junie-accessible models not available to the host agent. Also use when asked to set up Junie, verify an existing install, create or adjust ~/.junie/config.json or project .junie/config.json, bootstrap a repo’s .junie layout, wire in skills/guidelines/MCP/model locations, prepare Junie for CI headless usage, or decide whether interactive Junie flows truly require headless-terminal-style PTY control. Trigger on limited host-agent command phrases such as /junie help, /junie status, /junie model, /junie usage, /junie bootstrap, and /junie dry-run. --- # Junie

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill explicitly enumerates user and project Junie directories and shell environment details. In context this is for diagnostics, but it can still expose sensitive metadata such as installed components, project structure, and potentially secret-bearing config filenames or contents if the pattern is expanded by an agent, which increases information-disclosure risk in shared or untrusted environments.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
command -v junie || true junie --version || true printf '%s\n' "$SHELL" ls -la ~/.junie 2>/dev/null || true ls -la ./.junie 2>/dev/null || true ls -la ./.junie/skills 2>/dev/null || true

text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 71% confidence
Finding: The usage-summary workflow reads Junie runtime/session data and may encourage retention or reporting of model usage, token counts, and related metadata. While lower risk than config mutation, it still touches persisted session artifacts and could leak operational telemetry or sensitive contextual traces if exposed beyond the user.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
- project/user config model or provider, if present in `.junie/config.json` or `~/.junie/config.json` - Junie’s current launch model from read-only runtime state, usually `~/.junie/settings.json` keys such as `modelForLaunch` and `effortPerModel` - after a run, confirm from Junie logs when available; log lines containing `AgentParameters(modelParameters=ModelParameters(model=..., effort=...))` are a useful observed source - after a run, summarize observable usage when available: model(s), estimated cost, input/output tokens, cache read/write tokens, and any notable helper-model usage Use the bundled helper from the skill directory for a quick best-effort usage summary:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file recommends install methods that execute code fetched directly from the network, including a PowerShell example that bypasses execution policy, without any warning or verification guidance. In a skill used by an agent to install/configure software, this increases the chance that the agent will blindly run high-risk commands, exposing the host to supply-chain compromise or man-in-the-middle/repository compromise scenarios.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code creates the .junie directory structure and may overwrite .junie/AGENTS.md when --force-agents is used, but it does not prompt for confirmation or emit any warning before mutating the user's filesystem. Although bootstrapping implies setup actions, the overwrite behavior is safety-relevant and not specifically disclosed at the point of execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script reads any existing config and writes back a merged JSON object to .junie/config.json, which changes user configuration on disk. There is no confirmation prompt, warning, or explicit log explaining that the existing config file will be modified.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/summarize_junie_usage.py (reported line 152)May include surrounding context.
python
print(f" input tokens: {int(grand['inputTokens'])}") print(f" output tokens: {int(grand['outputTokens'])}") print(f" cache read tokens: {int(grand['cacheInputTokens'])}") cache_write = grand["cacheCreateTokens"] + grand["cacheCreateInputTokens"] print(f" cache write tokens: {int(cache_write)}") if grand["reasoningTokens"]: print(f" reasoning tokens: {int(grand['reasoningTokens'])}")

Static analysis

No suspicious patterns detected.