ClawHub
Back to skill

Security audit

Jira集成引擎(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Jira REST helper that can change live Jira data, but I found no hidden code, persistence, or unrelated behavior.

Install only if you intend to let an agent help with Jira REST API work. Treat create, update, sprint, transition, and comment examples as live production-changing actions, use least-privilege Jira tokens, and require explicit confirmation before any write operation.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill prominently documents create, update, transition, comment, sprint, and board operations against a live Jira instance, but it does not clearly warn users that these actions can modify remote project data and trigger real workflow changes. In an agent context, this increases the chance of unintended issue creation, status changes, assignments, or comments being executed on production Jira systems based on ambiguous or insufficiently confirmed user prompts.

Static analysis

No suspicious patterns detected.