Security audit
Security checks for vulnerabilities and agentic risk
This Jira skill is not clearly malicious, but it asks for broad agent authority around authenticated Jira and local command/file operations without enough scoping or user-control safeguards.
Review this skill before installing in an agent with real Jira credentials. Use only least-privilege Jira tokens, keep JIRA_URL pinned to a trusted Jira host, avoid broad environment-variable scans, and require explicit confirmation before any bulk creation, workflow transition, field/component change, webhook use, or CI/CD-triggered issue closure.
The skill claims sensitive data will not be exposed, yet it earlier instructs enumerating environment variables matching secret-related names. Even with masking in the sample command, this encourages broad secret discovery behavior and can expose credential presence, naming, and accidental unmasked variants in real agent executions or modified commands.
The documentation advertises broad file handling capabilities that are not necessary for a Jira PAT management skill. In an agent setting, unjustified read/write scope expands the attack surface and can lead to unintended access to local files, workspace data, or sensitive artifacts unrelated to Jira operations.
The skill metadata and description use very broad productivity and automation language, making it likely to activate on generic requests beyond Jira administration. Over-broad activation is dangerous for agentic tools because it can cause unintended tool selection, leading to credentialed network operations or command execution in contexts the user did not intend.
The invocation guidance tells the agent to act on natural-language requests without defining strict boundaries, confirmation steps, or Jira-specific trigger rules. In practice, this increases the chance that the skill will execute authenticated actions or shell commands from ambiguous user prompts.
The examples perform authenticated API calls using a personal access token directly in usage instructions without adjacent warnings about credential handling, endpoint trust, log exposure, and data sensitivity. Users or agents may copy these commands into unsafe environments, leaking tokens through shell history, process inspection, logging, or calls to untrusted Jira URLs.
No suspicious patterns detected.
