ClawHub
Back to skill

Security audit

jira-auto-analyze

Security checks for vulnerabilities and agentic risk

Overview

This JIRA automation has a clear purpose, but it is unsafe to install as-is because it includes plaintext reusable credentials and can modify live tickets.

Review before installing. Rotate the exposed JIRA password, remove credentials from all configs, scripts, and docs, require operator-provided secrets over HTTPS, pin dependencies, and use a least-privilege automation account with explicit approval before posting comments or changing assignees.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
config/config.json:45
Finding

Hardcoded JIRA Credentials Transmitted over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: config/config.json:45-48
Additional Locations: scripts/jira_auto_analyze.py:56-58, scripts/jira_auto_analyze.py:141-144, scripts/jira_auto_analyze.py:173-196, scripts/debug_jira_login.py:45-122, scripts/setup.py:136-149
Vulnerability Type: Hardcoded credentials and unencrypted authentication
Risk Level: High

Vulnerable Code

json
"jira_url": "http://jira.51baiwang.com",
"filter_id": "13123",
"username": "liuwei1",
"password": "Lw@123456",

The core automation also loads these values and enters them into the HTTP-hosted login form:

python
self.jira_credentials = {
    'username': self.jira_config.get('username', 'liuwei1'),
    'password': self.jira_config.get('password', 'Lw@123456')
}
python
jira_url = self.jira_config.get('jira_url', 'http://jira.51baiwang.com')
self.page.goto(jira_url, wait_until='networkidle')

username_input = self.page.locator('#login-form-username')
if username_input.count() > 0:
    username_input.fill(self.jira_credentials['username'])

password_input = self.page.locator('#login-form-password')
if password_input.count() > 0:
    password_input.fill(self.jira_credentials['password'])

Technical Analysis

A reusable JIRA username and password are committed directly to the project configuration and duplicated as fallback values in executable scripts. The setup script can also generate a configuration file containing the same credential, while the diagnostic login script embeds it independently.

Anyone who can read the package, repository, deployment artifact, backup, or generated configuration can recover the credential without executing the Skill. Removing only config/config.json would not resolve the issue because the same password remains in source defaults and documentation.

The configured JIRA URL uses plaintext HTTP. The browser submits the credential to that endpoin ...[truncated 1486 chars]

Remediation
View remediation

Remediation Suggestions

  1. Immediately revoke and rotate the exposed password. Review JIRA authentication and issue-change logs for unauthorized activity.
  2. Remove the username and password from configuration, source defaults, diagnostic scripts, documentation examples, generated files, and repository history.
  3. Load credentials from a managed secret store or protected environment variables. Do not provide usable fallback credentials.
  4. Fail closed when credentials are missing rather than silently using default values.
  5. Replace the HTTP URL with HTTPS and enforce valid certificate and hostname verification.
  6. Redirect HTTP requests to HTTPS server-side and prevent authentication over plaintext transport.
  7. Use a dedicated automation account with only the minimum projects and operations required.
  8. Prefer short-lived tokens or scoped API credentials over a reusable interactive password where JIRA supports them.
  9. Restrict secret-bearing configuration files to the service account, such as mode 0600, and exclude them from version control.
  10. Add secret scanning and checks that reject plaintext JIRA URLs in continuous integration.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/debug_jira_login.py:52
Finding

Diagnostic Screenshots Persist Potentially Sensitive JIRA Content

Content
View full analysis

Vulnerability Details

File Location: scripts/debug_jira_login.py:52-53
Additional Locations: scripts/debug_jira_login.py:143, scripts/debug_jira_login.py:156, scripts/debug_jira_login.py:165-166, scripts/simple_debug.py:32
Vulnerability Type: Insecure storage of diagnostic artifacts
Risk Level: Medium

Vulnerable Code

python
screenshot_path = os.path.join(
    os.path.dirname(__file__),
    '..',
    'logs',
    'jira_login_page.png'
)
page.screenshot(path=screenshot_path, full_page=True)

Further screenshots are captured before and after authentication:

python
page.screenshot(
    path=os.path.join(
        os.path.dirname(__file__),
        '..',
        'logs',
        'before_login.png'
    )
)

page.screenshot(
    path=os.path.join(
        os.path.dirname(__file__),
        '..',
        'logs',
        'after_login.png'
    )
)

final_screenshot = os.path.join(
    os.path.dirname(__file__),
    '..',
    'logs',
    'final_page.png'
)
page.screenshot(path=final_screenshot, full_page=True)

Another diagnostic script writes to a predictable shared temporary path:

python
page.screenshot(path="/tmp/jira_page.png")

Technical Analysis

The diagnostic scripts capture full-page screenshots of JIRA login and post-login states and write them to persistent, predictable paths. No restrictive file permissions, redaction controls, retention policy, or cleanup logic are applied.

A post-login screenshot may contain internal ticket information, usernames, project metadata, error details, or other confidential content. A screenshot taken before login may also capture a populated username or other authentication-related context. The fixed /tmp/jira_page.png path creates an additional local exposure because shared temporary directories are commonly accessible to multiple processes, and predictable names can create ...[truncated 1148 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable screenshot capture by default and require an explicit diagnostic option.
  2. Never capture a page while credentials are populated or while sensitive ticket content is visible.
  3. Redact or mask authentication fields, usernames, ticket descriptions, and other sensitive regions before capture.
  4. Create diagnostic files using secure temporary-file APIs with unpredictable names and mode 0600.
  5. Avoid fixed paths in shared temporary directories.
  6. Store approved diagnostics in a dedicated directory accessible only to the automation account.
  7. Delete screenshots automatically in a finally block after the diagnostic session unless an operator explicitly elects to retain them.
  8. Define a short retention period and prevent screenshots from entering source control, build artifacts, or centralized logs.
  9. Where screenshots are necessary, encrypt them at rest and record access to them.

T08 · Insecure Dependencies

Warning
Location
scripts/setup.py:42
Finding

Runtime Installation of Unpinned Playwright and Browser Artifacts

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.py:42-57
Additional Locations: INSTALL.md:35-36, USAGE.md:19-20, references/usage_guide.md:32-35
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

python
result = subprocess.run(
    [sys.executable, "-m", "pip", "install", "playwright"],
    capture_output=True,
    text=True
)
python
result = subprocess.run(
    [sys.executable, "-m", "playwright", "install", "chromium"],
    capture_output=True,
    text=True
)

Technical Analysis

The setup procedure installs the latest package published under the playwright name and then downloads a Chromium build selected by that package. No dependency version, package hash, browser revision hash, trusted mirror, or artifact signature policy is specified.

Consequently, the effective third-party code installed by the Skill can change after the Skill itself has been reviewed. A compromised upstream release, package index, repository account, download endpoint, or network path could cause an unreviewed package or browser artifact to be installed and executed. Even without a malicious compromise, an incompatible future release could alter automation behavior or introduce newly disclosed vulnerabilities.

The subprocess calls use argument arrays rather than shell=True, so no command-injection issue is established here. The risk arises from mutable and unverified supply-chain inputs.

Attack Path

  1. An operator runs scripts/setup.py and approves Playwright installation, or follows the equivalent commands in the documentation.
  2. pip resolves the current package version from its configured package source without a project-specified version or hash.
  3. Playwright subsequently retrieves the Chromium artifact associated with that mutable package version.
  4. If an upstream account, package release, configured ind ...[truncated 808 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Playwright to a specifically reviewed version in a dependency manifest or lock file.
  2. Require cryptographic hashes for Python packages, for example through a hash-locked requirements file.
  3. Pin and verify the expected Chromium revision and artifact integrity.
  4. Use a controlled internal package mirror or allowlisted package source rather than relying on mutable default resolution.
  5. Install dependencies inside an isolated virtual environment or container with no unnecessary credentials or filesystem access.
  6. Review and update pinned dependencies through a controlled process that includes vulnerability scanning and regression testing.
  7. Prevent setup from running with administrator or root privileges unless strictly necessary.
  8. Record resolved versions and artifact digests so installations can be reproduced and audited.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (76)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 202)May include surrounding context.

md
pkill -f "jira_auto_analyze"

# 2. 删除技能目录
rm -rf ~/.workbuddy/skills/jira-auto-analyze

# 3. 清理依赖（可选）
pip uninstall playwright

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 202)May include surrounding context.

md
pkill -f "jira_auto_analyze"

# 2. 删除技能目录
rm -rf ~/.workbuddy/skills/jira-auto-analyze

# 3. 清理依赖（可选）
pip uninstall playwright

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The finding indicates undeclared config read/write capability and generation of ticket-rejection comments or other workflow text beyond the stated purpose. In a business automation skill, hidden persistence and content-generation behavior can alter workflows, expose secrets in config, and make the agent act outside what users approved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The configuration embeds a live JIRA username and plaintext password directly in the skill file. Any user with access to the skill package, logs, backups, or source repository can recover these credentials and use them to access or modify tickets, comments, assignments, and potentially connected internal workflows. In this skill context, the danger is higher because the credential is paired with an internal JIRA URL and an automation purpose, making unauthorized operational access immediately actionable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The usage guide includes a concrete JIRA username and password in plaintext, which is a real secret exposure. Because this skill automates access to a production JIRA instance and can modify tickets, anyone with access to the skill files or logs could reuse the credentials for unauthorized access, ticket tampering, or pivoting into adjacent internal systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script is not limited to passive JIRA ticket analysis; it launches a browser, navigates to the JIRA instance, fills credentials, clicks login, and captures authenticated state. This creates active side effects and expands the skill from ticket triage into account use and system interaction, which is especially risky because the skill description only covers analysis and assignment of tickets.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
100% confidence
Finding

The script contains hardcoded JIRA credentials and automatically submits them to the server, which is a direct secret exposure and unauthorized automation risk. Anyone with code access can recover the credentials, reuse them, or trigger login actions against the internal JIRA system without user awareness or approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script embeds live JIRA credentials directly in code and default configuration, which exposes secrets to anyone with file access and encourages credential reuse in source control, logs, backups, and downstream packaging. In this skill’s context, the credentials are not just incidental: they enable authenticated access to internal ticket data and permit automated actions such as commenting and reassignment, making compromise materially harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Using embedded JIRA credentials without any user-facing disclosure means operators may unknowingly run automation under a privileged internal account. This is dangerous because the skill silently authenticates to a real system and can access or modify ticket data under those credentials, obscuring accountability and expanding the blast radius if the code is shared or reused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The installer embeds a concrete JIRA URL, username, and password and writes them to disk as a default config file. Hard-coded credentials are highly dangerous because anyone with repository or filesystem access can recover them, and the skill's purpose does not justify silently distributing reusable credentials in an installer.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/utils.py (reported line 132)May include surrounding context.

python
# 对于星舰工单，如果有匹配，立即返回（最高优先级）
        if rule.get('rule_name') == '星舰工单' and match_score > 0:
            return rule
    
    # 如果匹配分数大于0，返回匹配的规则
    if best_match and best_score > 0:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file presents all installation, safety, and operation instructions only in Chinese, including trigger phrases and critical warnings. Under the language/locale policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document explicitly labels the skill as approved and low risk while also embedding real-looking JIRA credentials and recommending code patterns that fall back to hardcoded default credentials. This normalizes insecure handling of secrets, increases the chance of credential reuse or accidental exposure, and may mislead users into trusting the skill despite contradictory evidence.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · INSTALL.md (reported line 24)May include surrounding context.

步骤1: 检查技能目录

bash
# 检查技能是否已创建
ls -la ~/.workbuddy/skills/jira-auto-analyze/

步骤2: 安装依赖

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly instructs users to run a script that will 'actually execute' against a live JIRA instance, but it does not clearly warn that this can automatically reassign tickets, post replies, and affect production workflow data. In the same document, example configuration includes plaintext credentials and a real-looking internal JIRA URL, which increases operational and privacy risk if users follow the instructions without understanding the consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.