Jira Expert.Old

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:13 AM UTC
• Version: 1.0.1

Overview

This is a coherent Jira administration skill with expected Jira-changing examples, but users should review automation rules before applying them in production.

Install only if you want an agent to help with Jira administration. Before using its automation examples in a real Jira site, review destructive actions, auto-approval rules, outbound notifications, and webhooks with your Jira admins and data-governance requirements.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The file presents 'Delete issue' as a supported action and elsewhere describes recipes as production-ready, but it does not specifically warn that deletion is destructive and may be irreversible. The general best-practice note that mistakes can be destructive is helpful but does not clearly disclose the risk at the point where deletion is introduced.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly promotes outbound actions like email, Slack, Teams, and web requests without a nearby warning that Jira smart values can contain sensitive issue data such as descriptions, emails, account IDs, and internal project metadata. In a Jira administration skill, users may copy these examples into production automation, causing unreviewed data disclosure to external systems or unintended recipients.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Assign to product owner
- Send email notification

### Auto-approve small bugs
**Trigger:** Issue created
**Conditions:**
- Issue type = Bug

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Priority IN (Low, Lowest)
**Actions:**
- Transition to "Approved"
- Add comment: "Auto-approved (low-priority bug)"

### Require security review
**Trigger:** Issue transitioned

• Confidence: 85% confidence
• Finding: The rule automatically transitions low-priority bugs to Approved without human review. While not malicious, this is a genuine governance risk: automated approval can bypass required triage or change-control checks, and an attacker or careless user could intentionally understate severity to push issues through an approval gate.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The webhook example transmits issue summary, description, and assignee data to an external GitHub API, but the documentation provides no warning about data classification, consent, redaction, or trust boundaries. In a Jira automation skill, users may copy this pattern directly into production and unintentionally exfiltrate sensitive internal ticket content or personal data to a third-party system.

Static analysis

No suspicious patterns detected.