jirac

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:10 AM UTC
• Version: 0.1.8

Overview

This skill is a disclosed Jira-management helper with powerful Jira actions, so users should verify commands and installer provenance before use.

Install jirac only from a source you trust, prefer a reviewed fixed version when possible, authenticate with a least-privilege Jira account, preview broad JQL queries with list commands first, and require explicit review before delete, archive, bulk edit, attachment upload, raw API, or MCP registration actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:6

Finding

Unpinned and Unverified Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4; references/install.md:6-24
Vulnerability Type: Supply-chain risk from unpinned and unverified executable dependencies
Risk Level: Medium

The Skill directs users and agents to install the security-sensitive jirac and optional jirac-mcp executables from multiple third-party distribution channels. No exact versions, immutable artifact references, checksums, or cryptographic signature-verification steps are provided.

Relevant code from SKILL.md:4:

yaml

metadata: {"openclaw":{"emoji":"🎫","requires":{"bins":["jirac"]},"install":[{"id":"github-releases","kind":"download","label":"Install jirac from GitHub Releases","url":"https://github.com/mulhamna/jira-commands/releases","extract":false}],"homepage":"https://github.com/mulhamna/jira-commands"}}

Relevant code from references/install.md:6-24:

markdown

## Recommended options

### Homebrew (macOS / Linux)

```bash
brew tap mulhamna/tap
brew install jira-commands

# Optional MCP server
brew install jira-mcp

Cargo

bash

cargo install jira-commands

# Optional MCP server
cargo install jira-mcp

npm

bash

npm install -g @mulham28/jirac

# Optional MCP server
npm install -g @mulham28/jirac-mcp

text

### Technical Analysis

These installation commands resolve the current package or release at installation time rather than a reviewed, immutable version. The GitHub Releases URL points to a mutable release listing and does not identify a specific artifact digest. The Homebrew, Cargo, and npm commands similarly omit version constraints and integrity-verification procedures.

This is security-sensitive because the installed CLI is expected to:

- Access locally stored Jira authentication credentials.
- Read and modify Jira issues and project data.
- Perform destructive and bulk Jira operations.
- Upload local attachment files.
- Se
...[truncated 2209 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation method to an exact reviewed version rather than resolving the latest available release.
2. For GitHub downloads, specify the exact release tag, artifact filename, and expected SHA-256 digest.
3. Publish signed checksums and document verification using an appropriate signing mechanism such as Sigstore, minisign, or GPG.
4. Ensure signatures are validated against a trusted, documented publisher identity rather than a key retrieved from the same untrusted download location.
5. For Cargo and npm, use exact versions and lockfile or integrity controls where supported. Avoid unconstrained global installation in automated agent environments.
6. Pin the Homebrew tap or formula to a reviewed revision and verify the formula's source URL and checksum.
7. Add package-ownership and publisher-identity verification instructions for each registry.
8. Run the CLI with least privilege and use a Jira account limited to the projects and actions required for the task.
9. Isolate the executable where practical, restrict access to unrelated local files, and review MCP configuration changes before registration.
10. Establish a controlled update process that reviews release provenance and integrity before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file provides ready-to-run bulk-transition, bulk-update, bulk-comment, and archive commands that can change many Jira issues at once, but it does not warn users about scope validation, dry-run checks, or irreversible/destructive effects. In an agent skill context, these examples may be reused directly in workflows, increasing the chance of accidental large-scale project changes from an overly broad JQL query or mistaken project selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.