ClawHub
Back to skill

Security audit

Maverick Jira Mcp

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Jira integration that stores Atlassian OAuth credentials locally and uses Atlassian's hosted MCP service with the connected user's Jira permissions.

Install only if you want the agent connected to Jira through Atlassian Rovo MCP. Use an Atlassian account with appropriate permissions, review any write actions before allowing them, avoid sending unrelated sensitive content through Jira tool calls, and revoke the OAuth grant in Atlassian when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
The output includes the server's `Instructions:` field (read it) and a JSON Schema for every tool's parameters. Treat this as the authoritative reference for the rest of the session.

**Step 2 — Call any tool from the catalog** using the form `maverick-jira-mcp.<tool>`:

```sh
mcporter --config {baseDir}/mcporter.json call maverick-jira-mcp.<tool> <arg>=<value> ...
Confidence
80% confidence
Finding
Call any tool

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal