📦

jira

Name: jira
Author: Joseph OBrien

v1.0.1 콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚙️ 외부 명령어🔑 환경 변수

Gestionar flujos de trabajo de Jira Cloud

Los equipos pierden tiempo cambiando entre herramientas de IA y Jira. Esta skill ayuda a Claude, Codex y Claude Code a buscar, actualizar y gestionar incidencias de Jira Cloud.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "jira" from https://skillstore.io/skills/89jobrien-jira.md and its manifest at https://skillstore.io/api/skills/89jobrien-jira/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/89jobrien-jira.md 서명된 manifest GET /api/skills/89jobrien-jira/manifest 서명된 lockfile GET /api/skills/89jobrien-jira/lockfile

테스트해 보기

"jira" 사용 중입니다. Encuentra incidencias no resueltas asignadas a mí en el proyecto APP.

예상 결과:

APP-14: El error de inicio de sesión está en curso y se actualizó hoy.
APP-22: El tiempo de espera de pago está abierto y tiene prioridad alta.
Siguiente paso sugerido: revisar las incidencias obsoletas antes de cambiar asignaciones.

"jira" 사용 중입니다. Resume APP-123 y sugiere la siguiente acción.

예상 결과:

APP-123 está esperando revisión. La siguiente acción es agregar una nota para el revisor y confirmar si los criterios de aceptación están completos.

"jira" 사용 중입니다. Prepara un comentario para el ticket de despliegue.

예상 결과:

Se preparó un comentario de Jira con el estado del despliegue, los resultados de validación y la acción restante del responsable en formato de texto enriquecido de Jira.

보안 감사

높은 위험

v7 • 2026. 7. 5. 버전별 보고서 열기

The skill is a legitimate Jira Cloud helper, and most markdown backtick findings are false positives from examples and inline references. It still handles Jira API credentials, reads .env configuration, and makes authenticated outbound requests. The main security concern is that JIRA_DOMAIN is not validated before credentials are sent.

스캔된 파일

1,123

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (5)

높음

scripts/jira-api.py:25

Environment file access

Environment variables (or .env file):

The script documentation explicitly supports credentials in a .env file. This is a common pattern, but it encourages local storage of Jira API tokens.

높음

scripts/jira-api.py:43

Environment file access

"""Load environment variables from .env file if present."""

load_env is dedicated to loading values from a .env file. Because those values include Jira credentials, this is sensitive file handling.

높음

scripts/jira-api.py:44

Environment file access

env_file = Path.cwd() / ".env"

The helper reads a .env file from the current working directory. That file can contain API tokens and domain configuration used in outbound requests.

높음

SKILL.md:21

Environment file access

Set these environment variables (or in `.env` file):

The skill instructs users to place Jira credentials in environment variables or a .env file. This is expected setup, but it creates secret-handling risk for users.

높음

scripts/jira-api.py:72-82 scripts/jira-api.py:93-106

Unvalidated Jira Domain Can Receive Credentials

The helper reads JIRA_DOMAIN from the environment, accepts arbitrary http-prefixed values, and sends the Basic Auth header to the resulting host. A mistaken or malicious domain value could receive the Jira email and API token.

The code directly derives the base URL from JIRA_DOMAIN and attaches Basic Auth headers before creating the request. This is legitimate Jira functionality, but the missing host allowlist creates a clear credential exposure risk.

기능 검토 항목 (14)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

references/api-endpoints.md:20

Shell command substitution

AUTH=$(echo -n "email@example.com:API_TOKEN" | base64)

The example builds a Basic Auth value from an email and API token in the shell. This is legitimate Jira documentation, but it handles credentials and can expose them if copied into unsafe shell history or logs.

중간

SKILL.md:159

Shell command substitution

AUTH=$(echo -n "$JIRA_EMAIL:$JIRA_API_TOKEN" | base64)

The curl example builds a Basic Auth value from Jira credentials using shell command substitution. It is legitimate, but copied commands can expose credential-derived values in shell contexts.

낮음

scripts/jira-api.py:85

HTTP client library

def make_request(method, endpoint, data=None, query=None):

make_request constructs authenticated outbound Jira API calls. Network access is expected for this skill, but it sends credentials to the configured remote host.

낮음

scripts/jira-api.py:151

HTTP client library

result = make_request(args.method, args.endpoint, data, args.query)

The CLI dispatches user-selected methods and endpoints to make_request. This is intended Jira functionality, but it performs authenticated outbound requests.

낮음

scripts/jira-api.py:38

Python HTTP libraries

import urllib.request

urllib.request is imported to perform Jira Cloud HTTP requests. The library use is expected, but it enables outbound network communication.

낮음

scripts/jira-api.py:106

Python HTTP libraries

req = urllib.request.Request(url, data=body, headers=headers, method=method)

The script creates a urllib request containing the Authorization header. This is real network behavior with credential-bearing headers.

낮음

scripts/jira-api.py:109

Python HTTP libraries

with urllib.request.urlopen(req) as response:

The script opens the urllib request and sends it over the network. This is expected for Jira access, but it is authenticated outbound traffic.

낮음

scripts/jira-api.py:80

Hardcoded URL

domain = f"https://{domain}"

The script prepends https to the configured Jira domain before making API calls. This is legitimate, but the resulting host controls where credentials are sent.

낮음

scripts/jira-api.py:52

Python environment access

if key not in os.environ:

The script checks process environment keys while importing values from a .env file. This is intended configuration handling, but it touches sensitive runtime state.

낮음

scripts/jira-api.py:53

Python environment access

os.environ[key] = value

The script writes parsed .env values into os.environ. That can affect credential resolution for the authenticated Jira request.

낮음

scripts/jira-api.py:58

Python environment access

email = os.environ.get("JIRA_EMAIL")

The script reads JIRA_EMAIL from the environment for Basic Auth. This is required behavior, but it handles account-identifying credential material.

낮음

scripts/jira-api.py:59

Python environment access

token = os.environ.get("JIRA_API_TOKEN")

The script reads JIRA_API_TOKEN from the environment for Basic Auth. This is sensitive credential access even though it is expected for Jira API use.

낮음

scripts/jira-api.py:74

Python environment access

domain = os.environ.get("JIRA_DOMAIN")

The script reads JIRA_DOMAIN from the environment to decide the remote API host. A wrong or malicious value changes where authenticated requests go.

낮음

SKILL.md:161

Hardcoded URL

curl -s "https://$JIRA_DOMAIN/rest/api/3/issue/PROJ-123" \

The curl example sends an authenticated request to the configured Jira Cloud domain. This is intended, but it is still credential-bearing outbound network access.

위험 요인

🌐 네트워크 접근 (9)

references/adf-format.md:180 scripts/jira-api.py:85 scripts/jira-api.py:151 scripts/jira-api.py:38 scripts/jira-api.py:106 scripts/jira-api.py:109 scripts/jira-api.py:80 SKILL.md:29 SKILL.md:161

⚙️ 외부 명령어 (41)

🔑 환경 변수 (5)

scripts/jira-api.py:52 scripts/jira-api.py:53 scripts/jira-api.py:58 scripts/jira-api.py:59 scripts/jira-api.py:74

감사자: codex 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/89jobrien-jira/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/89jobrien-jira/security.svg)](https://skillstore.io/skills/89jobrien-jira?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/89jobrien-jira?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/89jobrien-jira/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/89jobrien-jira.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

Joseph OBrien. (2026). jira security audit report (audit version 7) [Author version 1.0.1]. Skillstore. https://skillstore.io/skills/89jobrien-jira/audits/7

BibTeX 인용

@techreport{joseph-obrien-89jobrien-jira-2026,
  author = {Joseph OBrien},
  title = {jira security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/89jobrien-jira/audits/7},
  note = {Author version 1.0.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jira security audit report (audit version 7)"
version: "1.0.1"
type: report
authors:
  - name: "Joseph OBrien"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/89jobrien-jira/audits/7"
identifiers:
  - type: other
    value: "skillstore:89jobrien-jira:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Clasificar el trabajo del sprint

Encontrar incidencias activas, revisar responsables y estado, e identificar tickets que necesitan seguimiento.

Crear tickets estructurados

Convertir requisitos en tareas de Jira con resúmenes, etiquetas, prioridades y descripciones formateadas.

Automatizar actualizaciones rutinarias

Agregar comentarios, asignar tickets y mover incidencias a través de las transiciones configuradas del flujo de trabajo de Jira.

이 프롬프트를 사용해 보세요

Encontrar mis incidencias abiertas

Busca en Jira mis incidencias no resueltas en el proyecto PROJECT_KEY y resume la prioridad, el estado y la actualización más reciente.

Revisar un ticket

Obtén la incidencia de Jira PROJECT_KEY-123 y resume el estado actual, el asignado, los bloqueos y la siguiente acción útil.

Crear un elemento de trabajo

Crea una tarea de Jira en el proyecto PROJECT_KEY con este título, criterios de aceptación, prioridad y etiquetas. Usa una descripción ADF válida.

Planificar clasificación masiva

Crea una consulta JQL para incidencias en curso obsoletas, explica los criterios de coincidencia y luego propone actualizaciones seguras para cada resultado.

모범 사례

Usa tokens de Jira API con privilegios mínimos y rótalos según un calendario regular.
Previsualiza las actualizaciones de incidencias antes de escribir comentarios, asignaciones o transiciones.
Mantén las consultas JQL acotadas para evitar respuestas grandes y límites de tasa.

피하기

No almacenes tokens de Jira API en archivos confirmados ni en prompts compartidos.
No ejecutes operaciones amplias de actualización sin revisar la lista de incidencias afectadas.
No uses esta skill para eludir permisos de proyecto o flujos de aprobación.