Jira

• Analyzed: May 12, 2026, 4:29 AM
• Findings: 1
• Version: 1.0.0
• Hash: 094ce80531a4f84e5d19004ca65735a8c1331c7b938f749dbbacf1759459ca10
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to two main reasons found in `scripts/jira.sh`. First, it contains a hidden `metrics` command, not documented in `SKILL.md`, which can exfiltrate aggregated worklog data (total hours, issue count) to an arbitrary URL specified by the `JIRA_METRICS_URL` environment variable. While not directly stealing credentials, this undocumented data transmission to an arbitrary external endpoint is a risky capability. Second, the script is vulnerable to JQL injection in functions like `print_search` and `find_account_id`, where user-provided query strings are directly interpolated into JQL queries without sufficient sanitization, potentially allowing an attacker to alter query logic.