ClawHub
Back to skill

Security audit

项目管理工具

Security checks for vulnerabilities and agentic risk

Overview

This Jira skill is not clearly malicious, but it asks for broad local file and command powers that do not fit a normal Jira integration.

Review this skill before installing. It appears aimed at Jira automation, but only install it in an environment where broad local file access and shell execution are either removed or tightly sandboxed, and do not let Jira issue text or comments be treated as agent instructions. Callback destinations should be restricted to trusted HTTPS endpoints, and Jira write actions should require explicit user confirmation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:11
Finding

Excessive Filesystem and Command-Execution Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-15
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: High

Vulnerable Code

yaml
tools:
- read
- exec
- glob
- grep

Related capability claims also appear at SKILL.md:271-274 and SKILL.md:298-301, where the skill advertises generic file processing and system-command execution.

Technical Analysis

The skill's documented purpose is to manage Jira resources such as issues, epics, boards, sprints, transitions, and users. That purpose does not inherently require unrestricted local command execution, filesystem discovery, or arbitrary file reads.

Granting exec, read, glob, and grep expands the skill's authority beyond its legitimate Jira integration requirements. In particular:

  • glob can discover files outside the task's intended scope.
  • grep can search local files for credentials, tokens, configuration values, or other sensitive content.
  • read can expose discovered files to the agent or subsequent tool calls.
  • exec can run operating-system commands with the privileges of the hosting agent.

The risk is increased when Jira content or user input is untrusted. A malicious issue description, comment, or task instruction could attempt to persuade the agent to invoke these tools. Although no explicit malicious command is embedded in the audited file, the declared permissions create a dangerous execution surface and violate least-privilege principles.

The document also describes the skill as a pure Markdown skill near the end of the file, which is inconsistent with its declaration of command-execution capability.

Attack Path

  1. An attacker places malicious instructions in a Jira issue, comment, description, or other content processed by the skill.
  2. A user asks the agent to retrieve or process that Jira content.
  3. The malicious content instructs the agent to inspect the l ...[truncated 1208 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove exec, read, glob, and grep from the tool declaration when they are not strictly required for Jira operations.
  2. Replace generic system tools with narrowly scoped Jira API tools that expose only the required issue, project, sprint, board, and transition operations.
  3. If local file access is essential, restrict it to an explicit workspace directory and deny access to home directories, credential stores, environment files, SSH directories, and operating-system configuration.
  4. If command execution is unavoidable, use a fixed allowlist of commands and arguments rather than passing natural-language or user-controlled values to a shell.
  5. Require explicit user confirmation before any filesystem access or command execution unrelated to a direct Jira API request.
  6. Treat all Jira fields, comments, attachments, and descriptions as untrusted data. They must never be interpreted as agent instructions.
  7. Run the skill under a dedicated low-privilege account in a sandbox with a read-only filesystem wherever possible.
  8. Ensure the declared capability classification accurately reflects whether executable tools are available.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:44
Finding

Unrestricted User-Supplied Callback URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:44
Vulnerability Type: Unvalidated outbound callback destination
Risk Level: Medium

Vulnerable Code

markdown
| callback_url | string | Optional | Callback notification URL after asynchronous processing completes |

Technical Analysis

The skill accepts a caller-provided callback URL but does not define validation or destination restrictions. There are no documented requirements for:

  • HTTPS transport.
  • Trusted-domain allowlisting.
  • Rejection of loopback, private, link-local, or metadata-service addresses.
  • DNS rebinding protection.
  • Redirect validation.
  • Callback authentication.
  • Restrictions on the data included in callback requests.

If the hosting agent or integration sends a network request to this value, an attacker may be able to direct the request toward internal services or an attacker-controlled endpoint. This creates a potential server-side request forgery condition and a data-exfiltration channel.

The issue is configuration-driven rather than an embedded active exploit: the project contains no callback implementation. Exploitability therefore depends on whether the agent platform implements the documented callback behavior without independent URL validation.

Attack Path

  1. An attacker or untrusted caller supplies a crafted callback_url.
  2. The URL targets either an attacker-controlled server or a sensitive internal address, such as a loopback service, private network host, or cloud metadata endpoint.
  3. The skill processes a Jira operation using data available to the authenticated user.
  4. After processing, the agent or integration sends a callback request to the supplied destination.
  5. The request may reach an otherwise inaccessible internal service or disclose Jira result data to the external recipient.
  6. If redirects are followed without validation, an initially permitted URL may redirect the request to a ...[truncated 666 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove callback support if asynchronous outbound notifications are not essential.
  2. Require HTTPS and reject plaintext HTTP or non-HTTP schemes.
  3. Maintain an explicit allowlist of trusted callback domains and ports.
  4. Resolve hostnames before connecting and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
  5. Revalidate the destination after every DNS resolution and redirect. Prefer disabling redirects entirely.
  6. Authenticate callbacks using a per-recipient signing secret, such as an HMAC signature with a timestamp and replay protection.
  7. Send only a non-sensitive event identifier in the callback. Require the recipient to retrieve authorized details through a separately authenticated API.
  8. Apply outbound firewall or proxy controls so the agent cannot reach internal administrative or metadata services.
  9. Record callback attempts in an audit log without storing tokens, credentials, or sensitive payload contents.
  10. Enforce request timeouts, response-size limits, rate limits, and a restricted set of HTTP methods.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill metadata and description are entirely presented in Chinese, and the output section states the response format requirements without indicating that users may choose another language. Under the locale policy, a skill should not impose a specific language unless the constraint is explicitly justified or the user is given a language/locale option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document labels the skill as both 'MD+EXEC' and later as pure Markdown, creating ambiguity about whether it can execute actions. This inconsistency can lead users or agents to misjudge the skill’s capabilities and risks, including whether command execution or file-modifying behavior is possible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises command execution, file handling, and automation behavior without a clear upfront warning about the risks of running commands or modifying files. In an agent context, this increases the chance of unsafe execution, unintended filesystem changes, or sensitive data exposure because users may not realize the skill can trigger side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims commands run in a 'safe sandbox', but this file is only Markdown and provides no technical enforcement of sandboxing. That mismatch can cause operators to trust unsafe command execution paths and approve higher-risk actions under a false security assumption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.