Security audit

Jira API工具

Security checks across malware telemetry and agentic risk

Overview

This Jira skill is not malicious, but it requests broad local tools and describes high-impact Jira changes without clear scoping or confirmation safeguards.

Review this skill before installing. Use a least-privilege Jira/Maton token, avoid pasting OAuth client secrets or tokens into prompts, and require explicit confirmation for any create, update, transition, close, delete, or bulk Jira operation. Treat its generic command-execution and file-handling language as overbroad for a Jira integration.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation gives conflicting authentication guidance: most of the skill describes managed OAuth through Maton API keys, while the FAQ tells users to create their own Jira OAuth app credentials. This inconsistency can cause users to provision unnecessary secrets, misconfigure auth flows, or expose credentials in the wrong environment, increasing the chance of credential leakage and insecure deployment.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a Jira API tool but also claims generic file-processing and command-execution capabilities unrelated to that purpose. Broad, mismatched capability claims expand the apparent trust boundary and can lead an agent or user to authorize actions beyond expected Jira operations, increasing the risk of local data access or unintended system interaction.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly advertises command execution despite being a Jira integration, with no justification or guardrails for why shell access is needed. Unnecessary execution capability materially raises risk because it could be used to run local commands, inspect environment variables, or pivot beyond Jira API access if an agent follows the documentation too broadly.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance is overly broad, telling users to use the skill for general API integration, interface docking, webhook configuration, and system connection scenarios. In context, that ambiguity makes it easier for the skill to be invoked outside its intended Jira scope, which can cause over-privileged use, accidental data exposure, or unsafe automation decisions.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill describes issue creation and updates but does not prominently warn that some Jira operations may be destructive or workflow-altering, such as bulk updates, status transitions, closing, or deleting issues. In a Jira context this is especially dangerous because project data is collaborative and operational; an agent could make irreversible or disruptive changes without clear confirmation expectations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.