Security audit

项目管理工具

Security checks across malware telemetry and agentic risk

Overview

This Jira automation skill is mostly aligned with project-management work, but it asks for local command and file-search authority that is broader than its stated Jira purpose.

Review this skill before installing. Its Jira actions require real project access and may create or modify work items, which is expected, but the declared local command and file-search capabilities are broader than the Jira use case. Only use it in an agent environment where you can restrict or review command execution, local file access, Jira token permissions, and any callback URL destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill inconsistently describes itself as pure Markdown/natural-language driven while elsewhere declaring `exec` capability. This mismatch can mislead users and host agents about the true privilege level of the skill, increasing the chance that command execution is enabled or trusted under false assumptions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The feature list advertises file handling and command execution even though the main skill purpose is Jira workflow automation. That inconsistency creates unnecessary privilege expansion and can mask unexpected local-system actions behind a benign project-management description.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Declaring command-execution capability for a Jira/project-management skill is a risky over-privileging pattern. If an agent enables `exec` based on this manifest, prompts or downstream instructions could trigger arbitrary local command execution unrelated to Jira operations, turning a business workflow skill into a host-impacting one.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation promotes command execution and file-writing style capabilities without a prominent warning that these actions can alter the local system or data. Users may invoke the skill assuming it only manages Jira issues, when it may also read files or run commands, creating avoidable system and data exposure risks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Supporting a `callback_url` without explaining privacy, authentication, or outbound data-transfer risks can enable unintended exfiltration of task data to arbitrary endpoints. In an agent context, even normal Jira content may include sensitive project metadata, issue details, or user information.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.