Security audit

Jira Skills

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate Jira command-line skill, but it needs review because it can change Jira data and allows implicit agent invocation without clear confirmation boundaries.

Install only if you are comfortable giving the agent Jira access. Use a least-privilege Jira token, store any config file with restrictive permissions, disable implicit invocation or require confirmation before writes, and update the requests dependency floor before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly relies on environment variables and outbound network access to interact with Jira, but it does not declare those permissions explicitly. That weakens user and platform visibility into the skill's capabilities and can lead to over-trusting a skill that can read credentials and modify remote systems.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger text uses broad, everyday phrasing like looking up tickets, filing tasks, commenting, assigning, and moving issues, without clear boundaries for when the skill should or should not activate. In an agentic environment, that increases the chance of unintended invocation and accidental state-changing actions against Jira.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description presents Jira management capabilities but does not prominently warn that it can create issues, comment, assign users, and transition workflow state. Users may invoke it expecting informational behavior and unintentionally authorize changes to production project data.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The file enables allow_implicit_invocation without any visible trigger constraints, exclusions, or narrowing conditions. For a skill that can read, search, create, comment on, assign, and transition Jira issues, this increases the chance the agent will invoke the skill automatically in ambiguous contexts and perform unintended issue-management actions or expose ticket data.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill advertises very broad natural-language triggers such as checking status, creating bugs, and transitioning issues without defining clear confirmation boundaries for state-changing actions. In an agent context, this can cause unintended Jira mutations from ambiguous user requests or prompt injection embedded in surrounding conversation, especially because the skill can create issues, comment, assign, and transition workflow state.

Known Vulnerable Dependency: requests==2.25 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: requests==2.25

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.