Security audit

Jira Flow Skill Free

Security checks for vulnerabilities and agentic risk

Overview

This Jira skill is mostly purpose-aligned, but it can modify live Jira data and access team worklog information without clear confirmation or tight activation limits.

Install only if you intend agents to operate against Jira Cloud. Limit the API token and Jira account permissions, set JIRA_BOARD to the smallest project scope possible, and require manual confirmation before status changes, assignments, comments, issue creation, or worklog writes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation description is broad enough to match generic project-management requests, which can cause the agent to invoke this skill in contexts where the user did not explicitly request Jira operations. Because the skill includes state-changing commands via exec (status updates, assignment, comments, creation, worklogs), overbroad triggering raises the risk of unintended external side effects against a live Jira instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes operational capabilities but does not prominently warn that many commands modify live Jira data. In this context, omission is dangerous because users or calling agents may treat the skill as informational while it can actually change issue state, assignees, comments, created tickets, and worklogs in a production SaaS system.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The keyword coverage list is extremely broad and includes common terms unrelated to a clear Jira intent, making accidental or overly eager invocation more likely. In an agent environment with exec and network access, this can lead to unauthorized or unintended reads and writes to Jira Cloud, including issue creation, reassignment, commenting, status transitions, and worklog submission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation instructs users to configure Jira API tokens and send requests to Jira Cloud but lacks a prominent warning about secret handling, network transmission, and the sensitivity of issue/worklog data. In an agent-plus-exec setting, weak guidance around credentials increases the chance of token leakage through shell history, logs, screenshots, shared environments, or unsafe reuse.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The FAQ states that hours-day returns worklogs for all users and is suitable for a team view, which is a broader team aggregation capability. Later, the free-version limitations explicitly claim that '团队成员工时聚合视图' is restricted in the free edition, creating a manifest/documentation mismatch about what the free skill actually offers.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The front matter declares license: Proprietary, while the later copyright section says the improved work's license is MIT. This is an active contradiction in the skill's own documentation about redistribution and usage intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.