T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
Unrestricted Authenticated Jira API Helper
- Content
View full analysis
[body]}" ENDPOINT="${2:?Usage: jira.sh [body]}" BODY="${3:-}" URL="${JIRA_URL%/}${ENDPOINT}" if [ -n "$BODY" ]; then curl -s --http1.1 -X "$METHOD" \ -u "${JIRA_EMAIL}:${JIRA_TOKEN}" \ -H "Content-Type: application/json" \ -d "$BODY" "$URL" else curl -s --http1.1 -X "$METHOD" \ -u "${JIRA_EMAIL}:${JIRA_TOKEN}" \ -H "Content-Type: application/json" "$URL" fi ``` ### Technical Analysis The helper accepts an arbitrary HTTP method, Jira endpoint, and request body from its caller. It then attaches the configured Jira credential to every request. No method allowlist, endpoint allowlist, mutation confirmation, or authorization policy is enforced by the script. Although `SKILL.md` recommends pairing the helper with `chainwatch`, that control is optional and external to the implementation. Quoting the variables prevents ordinary shell metacharacter injection through these arguments, but it does not restrict which authenticated Jira operations may be performed. Consequently, any agent or process allowed to invoke this helper receives the full effective Jira authority of the configured account rather than only the permissions required by the documented search, linking, and due-date workflows. ### Attack Path 1. A user configures `jira.env` with a Jira account or token that has read and write privileges. 2. The OpenClaw agent is permitted to invoke `jira.sh`. 3. Malicious issue content, prompt injection, or an erroneous agent decision causes the agent to select an unintended HTTP method, endpoint, or body. 4. The helper attaches `JIRA_EMAIL` and `JIRA_TOKEN` and sends the request to the configured Jira instance. 5. Jira executes the operation with all privileges granted to that creden ...[truncated 590 chars]- Remediation
View remediation