Security audit

Jira集成技能

Security checks across malware telemetry and agentic risk

Overview

This Jira skill is not clearly malicious, but it asks for broad command and file access while also being able to change external Jira data.

Install only if you are comfortable giving this skill local read/write/command capability and authority to modify Jira records. Prefer a version scoped to Jira-only API calls, with least-privilege Jira credentials and explicit confirmation before creating, updating, or transitioning issues.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill presents itself as a Jira/API integration wrapper, but its documented and declared capabilities extend to file access and command execution. This mismatch increases the chance that an agent or user will invoke powerful local operations under the guise of a routine API integration, defeating least-privilege expectations and enabling abuse if untrusted input reaches exec or filesystem paths.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: System command execution is not justified for ordinary Jira API operations such as ticket creation or status updates. Granting exec to a broadly-triggered integration skill creates a direct path to command execution if user-controlled instructions are mapped to shell actions, which can lead to host compromise, data exfiltration, or persistence attempts.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documentation advertises file read/write handling even though the manifest frames the skill as an API integration utility. Unnecessary filesystem access broadens the attack surface by allowing local data exposure, tampering with workspace files, or staging of data used by other tools, especially when combined with broad triggers and automation contexts.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger language is overly broad, effectively positioning the skill for almost any API integration or system-connection request. Overbroad routing increases the likelihood that the skill is selected in contexts beyond Jira, where its powerful tools (exec, read, write) may be inappropriately exposed and used on unrelated tasks.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest trigger phrase is underspecified and does not clearly constrain when the skill should activate. In an agent environment, vague activation rules can cause unsafe tool selection, especially because this skill includes privileged capabilities that exceed what users would expect from a simple Jira connector.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes CRUD and state-updating behavior but does not provide a prominent warning that it can modify external Jira data or trigger destructive workflow changes. Without explicit user-facing warnings and confirmation requirements, an agent may perform unintended writes, status transitions, or automation actions that alter production project data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.