ClawHub
Back to skill

Security audit

Confluence

Security checks for vulnerabilities and agentic risk

Overview

This Confluence skill is mostly purpose-aligned, but it has unsafe argument handling and broad authenticated write authority that users should review before installing.

Install only if you trust the publisher and will use a narrowly scoped Atlassian API token. Review or fix the shell script before use, especially the python3 -c argument interpolation, URL validation, and write-command confirmation behavior. Avoid using a high-privilege Confluence account with this skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
confluence-cli.sh:256
Finding

Arbitrary Python Code Execution Through Unsafely Interpolated Command Arguments

Content
View full analysis
' + os.environ['COMMENT'] + ''} })) ") ``` #### Page title injection at lines 332–342 ```bash cmd_get_by_title() { local space_id="${1:?Usage: confluence-cli.sh get-by-title SPACE_ID \"Page Title\"}" local title="${2:?Usage: confluence-cli.sh get-by-title SPACE_ID \"Page Title\"}" local encoded_title=$(urlencode "$title") cf_get "$BASE/api/v2/spaces/$space_id/pages?title=$encoded_title&limit=1&body-format=storage" | python3 -c " import sys, json, re d = json.load(sys.stdin) results = d.get('results', []) if not results: print(json.dumps({'error': 'Page not found', 'title': '$title'})) else: ``` ### Technical Analysis The values of `labels_str`, `page_id`, and `title` originate in command-line arguments and are interpolated directly into source code supplied to `python3 -c`. Shell quoting does no ...[truncated 1722 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
confluence-cli.sh:19
Finding

Atlassian API Token Exposed Through Curl Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
confluence-cli.sh:20
Finding

Unvalidated Atlassian Base URL Can Disclose Credentials to an Arbitrary Endpoint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a local shell script and requires environment-based Atlassian credentials plus network access, but it does not declare any explicit tool scope or allowed-tools boundaries. That creates an authorization gap where the agent may be able to execute shell/network-capable behavior more broadly than reviewers or policy engines expect, increasing the risk of unintended data access or modification in Confluence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description includes broad terms like "wiki," "documentation," "pages," and "knowledge base," which can cause the skill to activate in loosely related contexts. Because this skill supports authenticated read and write operations against Confluence, accidental invocation could expose sensitive content or cause unintended page/comment/label modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script automatically reads Atlassian credentials from environment variables and immediately uses them for outbound API calls without any user-facing disclosure or confirmation. In an agent skill context, this can cause users to unknowingly authorize authenticated access to a remote Confluence tenant, increasing the risk of unintended data exposure or actions under their identity.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · confluence-cli.sh (reported line 39)May include surrounding context.

sh
cf_post() {
    local response http_code body
    response=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" -u "$AUTH" \
        -X POST -H "Content-Type: application/json" -H "Accept: application/json" \
        "$1" -d "$2")
    http_code=$(echo "$response" | tail -1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · confluence-cli.sh (reported line 55)May include surrounding context.

sh
cf_put() {
    local response http_code body
    response=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" -u "$AUTH" \
        -X PUT -H "Content-Type: application/json" -H "Accept: application/json" \
        "$1" -d "$2")
    http_code=$(echo "$response" | tail -1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The create and update commands perform remote state-changing operations against Confluence pages, but the script provides no explicit warning, dry-run, or confirmation before modifying live content. In an agent-driven environment, this creates a real risk of unintended page creation or overwrites, especially when user intent is ambiguous or arguments are generated automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The add-labels and add-comment commands modify remote Confluence content without clearly disclosing that they will write to the tenant. Although lower impact than page creation or updates, these actions can still alter metadata, create audit noise, or post unintended user-visible comments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.