Security audit

Workspace

Security checks across malware telemetry and agentic risk

Overview

The Jira logging skill has a coherent core, but it bundles real credentials, unrelated Google/Word automation, and under-scoped background service installers.

Review this package before installing. Remove bundled real credentials, avoid running the Google/Word automation unless you intentionally want those actions, and only install the LaunchAgent or background tracker if you are comfortable with a persistent local service that can create logs and send reminders.

SkillSpector

By NVIDIA

SkillSpector could not complete.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: format_google_doc_selenium.py:157

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_internal/network/auth.py:97

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_internal/network/auth.py:97

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_internal/network/session.py:312

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: jira_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_internal/network/session.py:312

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: word_automation_venv/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140