Jira Task Creator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:46 AM UTC
• Version: 2.1.0

Overview

This Jira automation skill is purpose-aligned, but it can send a Jira bearer token and issue or user data to any configured URL, including plaintext HTTP, while performing real Jira write actions without clear safeguards.

Review before installing. Use only an HTTPS Jira URL you control, use a least-privilege Jira token, rotate any token used over HTTP, and avoid bulk or natural-language issue creation unless you add a preview and confirmation step. Treat every successful call as a real Jira write operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: jira_task_creator.py:141

Finding

Jira bearer token and sensitive Jira data can be transmitted over plaintext HTTP

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:48

Finding

Python dependencies are not reproducibly pinned or hash-verified

Content

View full analysis

=3.7", "pip": [ "requests>=2.25.0", "python-dateutil>=2.8.0" ] } ``` The installation documentation does not specify versions, hashes, a package index, or a lockfile: ```bash pip install requests python-dateutil ``` ### Technical Analysis The declared dependencies are established Python packages, and the reviewed project contains no evidence that either dependency is currently malicious. The security issue is that installations are not reproducible: `>=` constraints and unconstrained `pip install` commands permit the resolver to select future releases that were not reviewed with this skill. No lockfile, exact-version requirements file, or cryptographic hashes are included. Consequently, two installations at different times may execute different dependency code. This expands the supply-chain trust boundary to all future matching releases and to the package index used during installation. Python packages may execute code during build or installation, and imported packages execute module initialization logic at runtime. A compromised upstream release, compromised package-index account, maliciously substituted package source, or unsafe future release could therefore execute code with the privileges of the user installing or running the skill. ### Attack Path 1. An attacker compromises a permitted dependency release channel, publishing infrastructure, or package-index account, or causes the installer to use a malicious package source. 2. The attacker publishes a release that satisfies `requests>=2.25.0` or `python-dateutil>=2.8.0`. 3. A user follows the documented installation command ...[truncated 1255 chars]

Remediation

View remediation

--hash=sha256: python-dateutil== --hash=sha256: ``` 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure installations to use an explicitly trusted package index or an internally controlled package mirror. 5. Review dependency release notes and security advisories before updating locked versions. 6. Add automated dependency scanning and a controlled update process that tests new versions before deployment. 7. Keep the human-readable dependency declarations synchronized with the authoritative lockfile so the documentation does not encourage unconstrained installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tainted flow: 'url' from os.getenv (line 210, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · jira_task_creator.py (reported line 152)May include surrounding context.

python

}

        try:
            response = requests.get(url, headers=headers, params=params, timeout=30)
            if response.status_code == 200:
                users = response.json()
                if users and len(users) > 0:

Tainted flow: 'url' from os.getenv (line 210, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · jira_task_creator.py (reported line 217)May include surrounding context.

python

}

    try:
        response = requests.post(url, headers=headers, json=issue_data, timeout=30)
        print(f"[INFO] Status code: {response.status_code}")

        if response.status_code == 201:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents setting a sensitive environment variable (JIRA_BEARER_TOKEN) and calling create_issue to send task data to a Jira server, but it provides no warning about transmitting project content to an external system or safeguarding credentials. For markdown files, omissions around behaviors affecting privacy or system integrity should be flagged when the skill description lacks warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation advertises CSV-based bulk task creation and templates that can modify Jira data at scale, but it does not warn users about the operational risk of creating many issues unintentionally or with malformed input. In a skill intended to automate Jira actions, omission of safeguards and warnings materially increases the chance of accidental mass changes, project spam, or workflow disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code hard-codes the due date format with a +08:00 timezone, which can silently create incorrect deadlines for users in other regions. In workflow systems this can lead to missed deadlines, mistaken scheduling, or policy violations when due dates are interpreted differently than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends summary, description, assignee, due date, and related task content to a remote Jira server without any built-in user-facing notice or consent step. This can cause unintended disclosure of sensitive operational or personal data, especially if the caller assumes the action is local or if the Jira endpoint is externally hosted.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jira_task_creator.py (reported line 217)May include surrounding context.

python

}

    try:
        response = requests.post(url, headers=headers, json=issue_data, timeout=30)
        print(f"[INFO] Status code: {response.status_code}")

        if response.status_code == 201:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest advertises broad natural-language Jira task creation but does not describe any trigger constraints, confirmation requirements, or exclusion conditions before performing a write action. In a skill that creates external tickets, ambiguous natural-language interpretation can cause unintended issue creation, mis-assignment, or misuse of privileged automation against Jira projects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill advertises user search by name, email, and open_id while also requiring a bearer token, yet the manifest provides no privacy guidance, access restrictions, or credential-handling warnings. This can facilitate user enumeration and unsafe handling of sensitive identifiers or authentication material, especially in enterprise Jira environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly supports batch task creation from CSV and templates but provides no warning, rate limit, preview, or approval flow for bulk write operations. This increases the risk of mass accidental or abusive ticket creation, which can disrupt Jira workflows, spam projects, and create operational cleanup burdens at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill supports searching users by email and maintaining Feishu-Jira user mappings, but the documentation does not mention privacy implications, data minimization, or access controls around user identity data. This can encourage collection or exposure of personal information beyond what operators expect, especially in enterprise environments where directory data is sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

User search queries are transmitted to Jira without explicit disclosure. While this is part of the feature, names or email addresses entered for lookup may still be sensitive in some environments, making silent transmission a privacy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.