Security audit

Jira PAT 管理专业版

Security checks across malware telemetry and agentic risk

Overview

This Jira skill is not clearly malicious, but it asks for broad agent authority around authenticated Jira and local command/file operations without enough scoping or user-control safeguards.

Review this skill before installing in an agent with real Jira credentials. Use only least-privilege Jira tokens, keep JIRA_URL pinned to a trusted Jira host, avoid broad environment-variable scans, and require explicit confirmation before any bulk creation, workflow transition, field/component change, webhook use, or CI/CD-triggered issue closure.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill claims sensitive data will not be exposed, yet it earlier instructs enumerating environment variables matching secret-related names. Even with masking in the sample command, this encourages broad secret discovery behavior and can expose credential presence, naming, and accidental unmasked variants in real agent executions or modified commands.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The documentation advertises broad file handling capabilities that are not necessary for a Jira PAT management skill. In an agent setting, unjustified read/write scope expands the attack surface and can lead to unintended access to local files, workspace data, or sensitive artifacts unrelated to Jira operations.

Vague Triggers

High

Confidence: 88% confidence
Finding: The skill metadata and description use very broad productivity and automation language, making it likely to activate on generic requests beyond Jira administration. Over-broad activation is dangerous for agentic tools because it can cause unintended tool selection, leading to credentialed network operations or command execution in contexts the user did not intend.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation guidance tells the agent to act on natural-language requests without defining strict boundaries, confirmation steps, or Jira-specific trigger rules. In practice, this increases the chance that the skill will execute authenticated actions or shell commands from ambiguous user prompts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The examples perform authenticated API calls using a personal access token directly in usage instructions without adjacent warnings about credential handling, endpoint trust, log exposure, and data sensitivity. Users or agents may copy these commands into unsafe environments, leaking tokens through shell history, process inspection, logging, or calls to untrusted Jira URLs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.