Jira Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:18 AM UTC
• Version: 0.1.1

Overview

This Jira skill is mostly coherent, but it asks users to install an unpinned third-party plugin and grant proxy access that can read and change live Jira data without clear scope controls.

Review this carefully before installing. Use a dedicated Jira account limited to the needed projects, confirm every create/update/comment/transition action before running it, verify or pin the MorphixAI plugin version where possible, and know how to rotate or revoke the MorphixAI API key and Jira connection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

text

1. **安装插件**: `openclaw plugins install openclaw-morphixai`

Technical Analysis

The documented installation command retrieves openclaw-morphixai without specifying an audited version, immutable digest, lockfile, or integrity checksum. Consequently, the installed package can change after this Skill has been reviewed.

The plugin is expected to operate in an environment containing MORPHIXAI_API_KEY and to perform Jira operations on behalf of the user. If the package registry, publisher account, distribution channel, or a future release is compromised, malicious plugin code could execute with the permissions available to the OpenClaw plugin process.

The repository contains only SKILL.md; it does not include the plugin implementation or other material with which to verify the behavior of the installed dependency.

Attack Path

1. An attacker compromises the plugin publisher account, package registry, or release process.
2. The attacker publishes a malicious version under the existing openclaw-morphixai package name.
3. A user follows the documented unpinned installation command.
4. The installer resolves and installs the attacker-controlled release.
5. The malicious plugin executes in the OpenClaw environment and attempts to read accessible credentials, intercept Jira data, or issue unauthorized operations through the linked account.

Impact Assessment

A compromised plugin could potentially access the MORPHIXAI_API_KEY, Jira issue content processed by the plugin, and any local resources exposed to the plugin process. It could also perform Jira read or write operations within the permissions granted to the linked MorphixAI/Jira account. The exact impact is bounded by the plugin runtime sandbox, local process privileges, and Jira aut ...[truncated 64 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a specific, reviewed version rather than resolving the latest available release.
• Where supported, verify the package against a cryptographic digest or signed provenance record.
• Maintain a dependency lockfile or equivalent immutable installation manifest.
• Document the authoritative package publisher and distribution source.
• Review the plugin source code and requested permissions before installation or upgrade.
• Run the plugin in a restricted environment that exposes only the required API key and network destinations.
• Establish an explicit update-review process instead of accepting plugin updates automatically.

other

Warning

• Location: SKILL.md:13

Finding

Jira Credentials and Operations Are Delegated to an External Proxy Without Documented Scope Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13 and 18-20
Vulnerability Type: Third-party data exposure and excessive trust delegation
Risk Level: Medium

Vulnerable Code

text

通过 `mx_jira` 工具管理 Jira Cloud 中的 Issue、项目和工作流。所有操作通过 MorphixAI 代理，无需直接管理 OAuth token。

text

2. **获取 API Key**: 访问 [morphix.app/api-keys](https://morphix.app/api-keys) 生成 `mk_xxxxxx` 密钥
3. **配置环境变量**: `export MORPHIXAI_API_KEY="mk_your_key_here"`
4. **链接账号**: 访问 [morphix.app/connections](https://morphix.app/connections) 链接 Jira 账号，或通过 `mx_link` 工具链接（app: `jira`）

Technical Analysis

The Skill explicitly requires users to create a MorphixAI API key, link a Jira account to MorphixAI, and route Jira operations through the MorphixAI proxy. This establishes an external trust boundary for potentially sensitive issue data and privileged Jira mutations.

The documentation does not specify the Jira OAuth scopes requested by the intermediary, tenant restrictions, credential lifetime, revocation procedures, data retention policy, or controls that enforce least privilege. It also does not require explicit user confirmation before issue creation, updates, comments, or workflow transitions.

This behavior is disclosed rather than covert, and the reviewed file does not prove malicious handling by MorphixAI. The risk arises from delegating Jira access to an external intermediary without documenting or enforcing the security boundaries necessary to evaluate and minimize that delegation.

Attack Path

1. A user creates a MorphixAI API key and links a Jira account as instructed.
2. MorphixAI obtains authorization to access the linked Jira environment.
3. Jira searches, issue contents, comments, and mutation requests are transmitted through the MorphixAI proxy.
4. If the proxy account, API key, intermediary service, or its infrastructure is compromised, an attacker may use the delegated authorization.
5. The attacker ...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

• Document every Jira OAuth scope requested by MorphixAI and justify why each scope is necessary.
• Use a dedicated Jira service account with access limited to the required projects and operations.
• Prefer read-only authorization when write operations are not required.
• Require explicit user confirmation before creating, updating, commenting on, or transitioning Jira issues.
• Document data retention, encryption, subprocessors, tenant isolation, audit logging, and credential revocation procedures.
• Provide clear instructions for rotating and revoking MORPHIXAI_API_KEY.
• Restrict the API key in the execution environment and prevent it from being logged or exposed to unrelated plugins.
• Consider supporting direct Jira OAuth access where practical to remove the additional proxy trust boundary.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill clearly enables state-changing Jira operations such as creating issues, updating fields, transitioning workflow states, and adding comments, but it does not prominently warn users that these actions modify remote project data. In an agent setting, missing mutation warnings can lead to unintended changes in production project management systems, especially when users expect read-only assistance or do not realize the tool has write capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.