ClawHub
Back to skill

Security audit

Jira REST API v3 Commons

Security checks for vulnerabilities and agentic risk

Overview

This Jira skill is purpose-built for real Jira API work, but it uses live credentials and shell commands with weak destination and temporary-file safeguards.

Install only if you intend the agent to make live Jira API calls with your Jira credentials. Use a least-privilege token, set ATREST_JIRA_BASE_URL only to your approved HTTPS Atlassian tenant, review create/update/transition/delete requests before execution, and prefer safer unique temp-file handling with cleanup.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
refs/cli-rest-quickref.md:31
Finding

Jira credentials can be transmitted to an unrestricted configured host

Content
View full analysis
&2 return 1 fi local url="${base}${path}" if [ -n "$query" ]; then url="${url}?${query}" fi if [ -n "$body_file" ]; then curl --silent --show-error --fail \ --request "$method" \ --url "$url" \ --header "Accept: application/json" \ --header "Content-Type: application/json" \ --header "$auth_header" \ --header "User-Agent: $ua" \ --data-binary "@$body_file" else curl --silent --show-error --fail \ --request "$method" \ --url "$url" \ --header "Accept: application/json" \ --header "$auth_header" \ --header "User-Agent: $ua" fi ``` The PowerShell implementation follows the same pattern: ```powershell $base = $env:ATREST_JIRA_BASE_URL.TrimEnd('/') $uri = if ($Query) { "$base$Path?$Query" } else { "$base$Path" } $headers = @{ Accept = 'application/json' Authorization = $auth 'User-Agent' = $ua } Invoke-RestMethod -Method $Method -Uri $uri -Headers $headers ``` ### Technical Analysis The request helpers derive the destination directly from `ATREST_JIRA_BASE_URL` an ...[truncated 1987 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:174
Finding

Predictable temporary JSON files enable local data disclosure and file overwrite

Content
View full analysis
/tmp/jira-body.json <<'JSON' { "fields": { "project": { "key": "PROJ" }, "issuetype": { "name": "Task" }, "summary": "Created from openClaw" } } JSON ``` The reusable quick reference uses another fixed path: ```bash cat > /tmp/jira-create.json <<'JSON' { "fields": { "project": { "key": "PROJ" }, "issuetype": { "name": "Task" }, "summary": "Create from Linux helper" } } JSON jira_api POST "/rest/api/3/issue" "" "/tmp/jira-create.json" ``` The Windows example also uses a predictable filename: ```powershell $tmp = Join-Path $env:TEMP 'jira-create.json' Set-Content -Path $tmp -Value $payload -Encoding UTF8 Invoke-JiraApi -Method Post -Path '/rest/api/3/issue' -BodyFile $tmp ``` ### Technical Analysis The Skill instructs the Agent to store Jira request bodies at fixed, predictable temporary paths. The files are created without exclusive creation, randomized names, explicit restrictive permissions, ownership validation, symlink checks, or cleanup. On a shared Unix-like host, a local attacker may prepare the predictable path before the Agent runs. Depending on operating-system hardening and filesystem configuration, shell redirection may follow a symbolic link and overwrite another file writable by the Agent. Alternatively, an attacker can pre-create a writable file at the expected path and retain ownership, allowing the attacker to read the Jira payload after it is written. Even without active exploitation, ordinary creation under a permissive process umask may leave issue descriptions, comments, account identifiers, project details, or other Jira data readable by other local users. The files are not deleted after transmission, extending the d ...[truncated 1496 chars]
Remediation
View remediation
"$body_file" <<'JSON' { "fields": { "project": { "key": "PROJ" }, "issuetype": { "name": "Task" }, "summary": "Created from openClaw" } } JSON ``` 2. Verify that the generated path is a regular file owned by the current user before passing it to the HTTP client. 3. Never reuse a fixed temporary filename across requests or processes. 4. Delete temporary request bodies in guaranteed cleanup logic, including failure and interruption paths. 5. On PowerShell, generate a cryptographically unique filename, apply an access control list limited to the current identity, and delete it in a `finally` block. 6. Prefer safely serialized in-memory request bodies when payload size and client behavior permit, avoiding filesystem storage entirely. 7. Do not place authentication tokens or other secrets inside temporary request-body files. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
# File: skills/jira-rest-v3/SKILL.md

# openClaw Skill — Jira Daily Work via ATREST (Jira Cloud REST API v3 + Jira Software Agile API)

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill explicitly instructs the agent to execute real outbound HTTP requests using environment-provided credentials. In a hostile or insufficiently constrained agent environment, this can cause unintended data exfiltration or unauthorized modification of Jira data, because the skill turns natural-language requests into live authenticated API calls. The surrounding context increases risk because the document repeatedly mandates execution rather than explanation.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Linux generic GET template

bash
curl --silent --show-error --fail \
  --request GET \
  --url "${JIRA_BASE}/rest/api/3/issue/PROJ-123?fields=summary,status,assignee,updated" \
  --header "Accept: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This Windows curl template has the same security issue as the Linux template: it operationalizes authenticated outbound requests directly from the OS shell. That makes the skill capable of transmitting Jira data externally and performing mutations if triggered by untrusted prompts, especially since the skill insists on actual execution and includes authorization header handling. The context therefore makes this more dangerous than a passive API reference.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

-Body (Get-Content -Path $tmp -Raw)

text

### Windows native curl template
```powershell
curl.exe --silent --show-error --fail `
  --request GET `

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest sets "language": "en", which is a natural-language policy concern when it fixes the skill to a single language without any visible opt-in or justification. The provided file does not indicate that users can select another language or that the English-only constraint is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs the agent to perform real CLI-based REST requests and emphasizes execution over explanation, but it does not warn that requests will send data to an external Jira service using live credentials. In an autonomous or semi-autonomous skill, that omission can lead to unintended transmission of sensitive project data or authenticated actions without clear operator awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This helper performs authenticated external HTTP requests to a Jira instance using bearer tokens or basic credentials, which is inherently a data transmission boundary. In context this is expected functionality, but it still represents a real security concern because the skill is designed to push data off-host and may transmit sensitive issue content or perform remote actions if invoked without proper controls.

Content

Scanner excerpt · refs/cli-rest-quickref.md (reported line 55)May include surrounding context.

md
fi

  if [ -n "$body_file" ]; then
    curl --silent --show-error --fail \
      --request "$method" \
      --url "$url" \
      --header "Accept: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The examples include commands that create Jira issues and write payloads to temporary files, but they do not clearly warn users that these actions are state-changing and will modify both remote Jira data and the local filesystem. In an agent skill context, this is risky because an automated agent may execute examples directly rather than treat them as illustrative, causing unintended ticket creation or leaving sensitive request data in temp files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The Windows curl example demonstrates a direct authenticated call to a remote Jira endpoint, so it crosses an external transmission boundary and could expose metadata or enable further access if copied blindly. Although this is normal for a Jira REST quick reference, examples that embed live request patterns can still be executed unintentionally by an agent or user without understanding the remote impact.

Content

Scanner excerpt · refs/cli-rest-quickref.md (reported line 190)May include surrounding context.

4) curl on Windows

Use curl.exe, not bare curl, to avoid the PowerShell alias confusion.

powershell

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file instructs users to store structured JSON in Jira issue properties and elsewhere describes posting comment bodies, which affects persistent user/project data. The document presents these write patterns as recommendations but does not include any warning about editing live issue content or metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow explicitly says the agent writes or updates Mermaid source in issue descriptions or comments. Because this changes shared ticket content, the skill description should disclose that behavior so users understand it will modify Jira records.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:148