Jira Expert Brajesh 1

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

This is a broad Jira helper skill with visible Jira administration and automation guidance, but I found no hidden execution, persistence, credential theft, or deceptive behavior.

Install only if you intend to let an agent help with Jira administration and automation. Review proposed Jira MCP commands before running them, test workflow and automation changes in a sandbox, preview bulk edits, and avoid webhook or notification payloads that send sensitive issue descriptions, user identities, or customer data to unapproved systems.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The code only implements a narrow subset of the declared description: JQL query building and basic syntax validation. It does not integrate with Jira APIs, create or manage projects, configure workflows, custom fields, automation, dashboards, or perform broader Jira administration/operations. The declared purpose substantially overstates the skill’s capabilities and primary scope relative to the supplied code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation text is extremely broad and could cause the skill to trigger for a wide range of ordinary Jira-related requests, including cases that may not require elevated project-admin style guidance. Overbroad matching increases the chance that a high-capability skill is invoked unnecessarily, which can lead to unintended administrative actions or overcollection of context.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Claiming to handle 'all technical and operational aspects of Jira' removes meaningful scope limits and encourages invocation in sensitive contexts, including permissions, workflows, automation, and bulk changes. In this skill context, that broad mandate is more dangerous because the document includes administrative and potentially high-impact operations, so an overbroad trigger could steer an agent toward powerful actions without adequate scoping.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document recommends a 'Send web request' automation action to external services without any caution about transmitting Jira issue data, user identifiers, comments, or other potentially sensitive metadata outside Atlassian. In a Jira automation context, users may directly include smart values such as issue fields and email addresses in outbound requests, creating a realistic risk of unintended data exfiltration or privacy/compliance violations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Assign to product owner
- Send email notification

### Auto-approve small bugs
**Trigger:** Issue created
**Conditions:**
- Issue type = Bug

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Assign to product owner
- Send email notification

### Auto-approve small bugs
**Trigger:** Issue created
**Conditions:**
- Issue type = Bug

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The GitHub webhook example transmits Jira issue fields such as summary, description, and assignee to an external system without any note about data classification, minimization, or authorization checks. In practice, issue descriptions often contain internal, customer, or security-sensitive information, so presenting this as a drop-in example can lead to unintended data disclosure.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The Slack notification recipe includes issue identifiers and assignee identity in a message to an external collaboration platform without warning about data sharing boundaries. While common operationally, this can leak internal project details or personal data into broader channels, guest-accessible workspaces, or retained third-party logs.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This recipe auto-transitions issues from Resolved to Closed on a schedule, which can affect audits, reopen workflows, and user expectations. Although the action is documented functionally, the recipe does not warn that automatic state changes should be reviewed and tested carefully before enabling.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The Confluence webhook example describes sending Jira-derived data to another platform without warning about cross-system data flow or permissions boundaries. Although the example is less explicit about sensitive fields than the GitHub case, it still normalizes external transmission without reminding users to validate destination access and data sensitivity.

Static analysis

No suspicious patterns detected.