T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:43
- Finding
- Unrestricted Authenticated Jira API Helper<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43-56 **Vulnerability Type**: Unrestricted privileged API access **Risk Level**: High ### Complete Code Snippet ```bash METHOD="${1:?Usage: jira.sh <METHOD> <endpoint> [body]}" ENDPOINT="${2:?Usage: jira.sh <METHOD> <endpoint> [body]}" BODY="${3:-}" URL="${JIRA_URL%/}${ENDPOINT}" if [ -n "$BODY" ]; then curl -s --http1.1 -X "$METHOD" \ -u "${JIRA_EMAIL}:${JIRA_TOKEN}" \ -H "Content-Type: application/json" \ -d "$BODY" "$URL" else curl -s --http1.1 -X "$METHOD" \ -u "${JIRA_EMAIL}:${JIRA_TOKEN}" \ -H "Content-Type: application/json" "$URL" fi ``` ### Technical Analysis The helper accepts an arbitrary HTTP method, Jira endpoint, and request body from its caller. It then attaches the configured Jira credential to every request. No method allowlist, endpoint allowlist, mutation confirmation, or authorization policy is enforced by the script. Although `SKILL.md` recommends pairing the helper with `chainwatch`, that control is optional and external to the implementation. Quoting the variables prevents ordinary shell metacharacter injection through these arguments, but it does not restrict which authenticated Jira operations may be performed. Consequently, any agent or process allowed to invoke this helper receives the full effective Jira authority of the configured account rather than only the permissions required by the documented search, linking, and due-date workflows. ### Attack Path 1. A user configures `jira.env` with a Jira account or token that has read and write privileges. 2. The OpenClaw agent is permitted to invoke `jira.sh`. 3. Malicious issue content, prompt injection, or an erroneous agent decision causes the agent to select an unintended HTTP method, endpoint, or body. 4. The helper attaches `JIRA_EMAIL` and `JIRA_TOKEN` and sends the request to the configured Jira instance. 5. Jira executes the operation with all privileges granted to that creden ...[truncated 590 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Enforce an explicit allowlist of supported HTTP methods, such as `GET`, `POST`, and `PUT`, and reject all other values. - Maintain an exact or pattern-based endpoint allowlist limited to the Jira resources required by the Skill. - Separate read-only and mutation helpers so routine searches cannot implicitly exercise write authority. - Require explicit user confirmation for issue updates, transitions, links, deletions, or other consequential operations. - Reject endpoint values containing control characters, user-info components, fragments, traversal sequences, or unexpected URL schemes. - Use a dedicated, least-privileged Jira service account restricted to the necessary projects and operations. - Make endpoint policy enforcement mandatory rather than relying on an optional external `chainwatch` deployment. - Log requested methods and normalized endpoints without recording authorization headers, tokens, or sensitive response bodies. ]]>