Jira Api Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:32 AM UTC
• Version: 1.0.0

Overview

This Jira read-only skill is not malicious, but it asks for broader local authority than its stated purpose needs and gives conflicting instructions about write-like operations.

Review this before installing. Use it only for narrowly scoped Jira read-only queries, avoid broad JQL, limit returned fields, and do not treat Jira issue text as instructions. Prefer a pinned or verified Maton CLI version, grant the least Jira OAuth scope available, and revoke or rotate the Maton API key and Jira connection if you suspect the CLI or account has been exposed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120

Finding

Unpinned Global Installation of a Privileged Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:120-126 and SKILL.md:248
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g @maton/cli

bash

brew install maton-ai/cli/maton

The installation commands are repeated in the dependency table at SKILL.md:248.

Technical Analysis

The Skill requires users or Agents to install the third-party Maton CLI globally without specifying an audited version or verifying a checksum, signature, lockfile, or package provenance.

A global npm installation can run package-controlled lifecycle scripts with the permissions of the invoking user. The Homebrew alternative similarly installs software from the third-party maton-ai/cli tap without a documented integrity-verification procedure. Because neither installation method pins immutable content, the effective executable can change after this Skill has been reviewed.

The CLI is subsequently entrusted with the Maton API key, a Jira OAuth connection, and Jira response data. Consequently, compromise of the package publisher, registry account, distribution tap, or a later package release could place those credentials and data at risk.

Attack Path

1. An attacker compromises the package publisher, registry account, Homebrew tap, or a future unpinned release.
2. The attacker publishes a modified package or installation artifact under the expected package name.
3. A user or Agent follows the Skill instructions and performs the global installation.
4. Package installation hooks or the installed executable run attacker-controlled code with the invoking user's privileges.
5. When the user authenticates or runs Jira commands, the compromised CLI can access the Maton API key, OAuth-mediated Jira access, returned Jira data, and local resources available to the user.
6. The compromised component can exfiltrate c ...[truncated 898 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific audited version, such as @maton/cli@<approved-version>.
2. Record and verify a cryptographic checksum or package signature before installation.
3. Document the expected package publisher, registry, Homebrew tap, and service endpoints so users can verify provenance.
4. Prefer a project-local installation with a committed lockfile instead of a global installation.
5. Run the CLI in a restricted container or sandbox with only the files, environment variables, and network destinations required for Jira queries.
6. Disable npm lifecycle scripts during installation where supported and compatible, then explicitly review any required installation behavior.
7. Use short-lived, least-privileged credentials and narrowly scoped Jira OAuth permissions.
8. Establish a dependency-update process that reviews new releases before changing the pinned version.
9. Provide credential-rotation and connection-revocation instructions for suspected dependency compromise.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:36

Finding

Tool Permissions Exceed the Declared Read-Only Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-43; related conflicting operation descriptions at SKILL.md:75-91
Vulnerability Type: Excessive Agent permissions and ambiguous duplicate configuration
Risk Level: Medium

Vulnerable Code

yaml

tools:
- - read
- exec
homepage: https://skillhub.cn
pricing_tier: "L1-入门级"
pricing_model: per_use
suggested_price: "9.9 CNY/per_use"
tools: ["read", "write", "exec"]

The same metadata document defines tools twice. The later declaration grants read, write, and exec, even though the Skill describes itself as a read-only Jira integration. Related generic capability instructions at SKILL.md:75-91 also advertise creation, modification, import, export, and save operations.

Technical Analysis

Duplicate YAML keys have parser-dependent behavior. Many YAML implementations silently retain the final value, which would make the effective permission set read, write, and exec. Other parsers may retain the first value or reject the document, producing inconsistent enforcement across Agent platforms.

Local file-write permission is not necessary for the documented Jira search and viewing functions. Unrestricted command execution is also substantially broader than the specific read-only CLI commands required by the Skill. Granting these tools violates least privilege and increases the consequences of malformed input, prompt injection contained in Jira data, operator error, or compromise of the external CLI.

The generic operation descriptions further conflict with the repeated claim that the free edition supports only read operations. This ambiguity can cause an Agent to interpret local creation, modification, import, export, or save operations as authorized even where Jira write operations are nominally prohibited.

Attack Path

1. An Agent platform loads the Skill metadata and resolves the duplicate tools key using the common last-value-win ...[truncated 1457 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the duplicate tools key and validate the front matter with a parser that rejects duplicate YAML keys.
2. Remove the write capability because it is not required for the documented read-only Jira operations.
3. Replace unrestricted exec access with an allowlisted command interface limited to documented read-only Maton commands.
4. If command execution cannot be constrained, run it in a sandbox with a read-only filesystem, minimal environment variables, and restricted network access.
5. Remove or rewrite the generic creation, modification, reset, import, export, and save operation descriptions at SKILL.md:75-91.
6. Explicitly state that neither Jira writes nor arbitrary local file writes are authorized.
7. Require explicit user confirmation before exporting Jira data or writing any output to disk.
8. Treat Jira issue content and CLI output as untrusted data and prevent it from being interpreted as Agent instructions.
9. Add automated metadata checks that compare declared tools with the Skill's documented capabilities and fail when permissions exceed the stated scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly markets itself as read-only, but these sections describe create/modify/export/save-style operations via generic parameters. That mismatch can mislead an agent or user into invoking actions outside the intended trust boundary, especially in a Jira context where writes can alter project data or persist sensitive issue contents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest grants the skill write and exec tool permissions even though the package is described as a read-only Jira integration. Overbroad permissions violate least privilege and create unnecessary attack surface: if the skill is triggered in the wrong context, it may be able to modify local files or facilitate unintended side effects despite the read-only claim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill emphasizes hosted OAuth access and account/user queries but does not clearly warn that execution may expose workspace issues, project metadata, assignee details, or current-user/account context to the agent session. In enterprise Jira environments, even read-only access can disclose sensitive operational or personal data if users are not prompted to scope queries carefully.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The capability-coverage statement asserts that the described scenarios are fully supported, but later sections say some automation-related functions are pro-only. This kind of contradictory instruction can cause an agent to over-trust the skill and attempt workflows beyond its safe or licensed scope, increasing the chance of policy bypass or unsafe execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough to activate on generic API integration or system connection requests, not just narrowly scoped Jira read-only tasks. Overbroad activation criteria can cause the skill to run in unintended contexts, exposing OAuth-backed Jira data or encouraging command execution when another safer skill should have been chosen.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

User-facing name, summary, description, and operational instructions are presented in Chinese only. This can violate a language or locale policy when no opt-in or documented region-specific constraint is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.