jira-communication
The skill requests excessive workspace-wide write permissions and insecurely mandates storing sensitive Jira credentials in predictable local files vulnerable to exfiltration by malicious processes.
Skill Info
Install
npx skills add https://github.com/netresearch/jira-skillAssessments (1)
AI Agent Traps ↗Access to known credential file paths detected
~/.env
The skill instructs the user to store sensitive Jira API tokens and credentials in '~/.env.jira' or '~/.jira/profiles.json', which are common targets for exfiltration by other malicious processes or skills.
Config via ~/.env.jira or ~/.jira/profiles.json.
The skill requests 'Write' access to the entire workspace, which is excessive for a Jira communication tool that should ideally only interact with the Jira API and local configuration files.
allowed-tools: Bash(python:*) Bash(uv:*) Read Write
Badge
[](https://mondoo.com/ai-agent-security/skills/github/netresearch/jira-skill/jira-communication)<a href="https://mondoo.com/ai-agent-security/skills/github/netresearch/jira-skill/jira-communication"><img src="https://mondoo.com/ai-agent-security/api/badge/github/netresearch/jira-skill/jira-communication.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/netresearch/jira-skill/jira-communication.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow