JIRA

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Jira helper that can read and change Jira tickets using the user's configured Jira access, with explicit approval safeguards for modifications.

Install this only if you want the agent to use your configured Jira CLI or Atlassian MCP connection. Treat create, update, transition, assignment, sprint, and comment actions as real changes to shared Jira data, and approve them only after checking the target issue, project, and proposed command.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Approved actions can change Jira tickets and notify coworkers or watchers.

Why it was flagged

The skill exposes Jira operations that can create, update, transition, assign, or comment on tickets. This is expected for the skill, and the same file instructs the agent to show commands and get approval before modifications.

Skill content
Create issue | `jira issue create -tType -s"Summary" -b"Description"` ... Move/transition | `jira issue move ISSUE-KEY "State"` ... Add comment | `jira issue comment add ISSUE-KEY -b"Comment text"`
Recommendation

Review each proposed Jira command or MCP call before approving, especially transitions, assignments, comments, sprint changes, and any bulk operation.

What this means

The skill can act with whatever Jira permissions are available to the configured CLI, MCP connection, or API token.

Why it was flagged

The skill may use Jira API credentials for REST/curl fallback and also supports Jira CLI or Atlassian MCP backends that rely on the user's configured Jira identity.

Skill content
"JIRA_API_TOKEN" ... "Needed for REST/curl fallback"; "JIRA_USER" ...; "JIRA_BASE_URL" ...
Recommendation

Use a Jira account or API token with only the permissions you are comfortable granting, and confirm the target Jira instance before running write operations.

What this means

Your Jira access depends on the externally installed jira CLI or the configured MCP service.

Why it was flagged

The skill is instruction-only and does not auto-install code, but its recommended setup depends on an external CLI installation and local initialization.

Skill content
brew install ankitpokhrel/jira-cli/jira-cli
jira init
Recommendation

Install the jira CLI only from its trusted source, keep it updated, and verify the MCP service configuration before connecting Jira credentials.

What this means

Jira issue contents and updates may pass through the configured Atlassian MCP tool connection.

Why it was flagged

The skill can route Jira reads and writes through Atlassian MCP tools. This is disclosed and purpose-aligned, but users should understand that Jira data and actions are mediated through the configured MCP connection.

Skill content
If no CLI, check for Atlassian MCP: → Look for mcp__atlassian__* tools → If available: USE MCP BACKEND
Recommendation

Use only a trusted Atlassian MCP configuration and verify which Jira workspace/account it is connected to.