Skills jira-safe
📦
jira-safe
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access
Organize SAFe Jira Workflows
SAFe planning in Jira is hard to keep consistent across epics, stories, and subtasks. This skill provides structured templates and scripts for Jira issue creation and workflow updates.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "jira-safe" from https://skillstore.io/skills/01000001-01001110-jira-safe.md and its manifest at https://skillstore.io/api/skills/01000001-01001110-jira-safe/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "jira-safe". Create a story for password reset in a team-managed Jira project.
Expected outcome:
A SAFe story with persona, goal, benefit, Given-When-Then criteria, definition of done, and suggested subtasks.
Using "jira-safe". Plan an MVP backlog for a marketing assistant product.
Expected outcome:
An epic outline with business outcomes, success metrics, grouped stories, implementation subtasks, and Jira linking guidance.
Using "jira-safe". Move SCRUM-100 from To Do to Done after implementation.
Expected outcome:
A transition checklist that queries available Jira transitions, selects the matching state, adds completion notes, and confirms the update.
Security Audit
High Riskv11 • 7/7/2026 Open versioned report
The many command-execution and certificate findings are mostly false positives caused by Markdown backticks, JavaScript template literals, and Jira issue key fields. Real risks remain because the skill and scripts use Jira credentials, perform authenticated network writes, and include destructive bulk-delete guidance.
8
Files scanned
4,225
Lines analyzed
78
Review items
0
False positives ignored
Confirmed security concerns (16)
High
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
High
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
High
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
High
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
High
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
High
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
Show all 16 confirmed findings
High
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Environment file access
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads JIRA_EMAIL as part of the Basic authentication credential pair. It is expected but still sensitive account-identifying data.
High
Environment file access
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads JIRA_API_TOKEN, a secret used to build Basic authentication for Jira API calls. Exposure or misuse of this token would affect the Jira account.
High
Environment file access
# Load .env file from jira root (two levels up from scripts/)
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Environment file access
env_path = Path(__file__).parent.parent.parent / '.env'
The Python helper loads a parent .env file that can contain Jira credentials. Reading local environment files is a real sensitive-file access pattern.
High
Destructive Jira Bulk Delete Helper
The skill documents a helper that searches all issues in a project and deletes each issue with deleteSubtasks=true. This can remove a large Jira backlog if copied or executed with a privileged token.
Lines 341-355 show a bulk delete routine that searches Jira issues and sends DELETE requests. The behavior is explicit and destructive, though it is documented rather than hidden.
Medium
Bulk Jira Issue Creation Without Interactive Confirmation
Executable scripts create epics, stories, and subtasks directly when run. They do not implement a dry-run or interactive confirmation step before writing to Jira.
The cited code calls createIssue for epics, stories, and subtasks in loops. No confirmation gate or dry-run branch is present in those execution paths.
Capability review items (78)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Fetch API call
await fetch(`${JIRA_URL}/rest/api/3/issue/${issue.key}?deleteSubtasks=true`, {
This Jira API request performs DELETE against issue URLs with deleteSubtasks=true. It can remove project issues if executed with a privileged token.
Medium
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Fetch API call
const response = await fetch(url, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Fetch API call
const response = await fetch(url, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Fetch API call
const response = await fetch(url, { headers });
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
HTTP client library
def make_request(method, path, data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
HTTP client library
return make_request('GET', f'/issue/{issue_key}?fields=summary,issuetype')
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
Medium
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Fetch API call
const response = await fetch(url, { ...options, headers });
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
HTTP client library
def jira_request(path, method='GET', data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
HTTP client library
return jira_request('/issue', method='POST', data={'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
Medium
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Environment variable access (dot notation)
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable access (dot notation)
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_EMAIL = process.env.JIRA_EMAIL;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Environment variable object
const JIRA_API_TOKEN = process.env.JIRA_API_TOKEN;
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
HTTP client library
def make_request(method, path, data=None):
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
HTTP client library
return make_request('POST', '/issue', {'fields': fields})
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python HTTP libraries
from urllib.request import Request, urlopen
The executable script uses HTTP requests to Jira with an Authorization header. This is intended automation, but it can create or inspect remote Jira data.
Medium
Python environment access
os.environ.setdefault(key.strip(), value.strip())
This line loads values from a .env file into process environment variables. The surrounding block is used to provide Jira credentials to API calls.
Medium
Python environment access
JIRA_EMAIL = os.environ.get('JIRA_EMAIL')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Medium
Python environment access
JIRA_API_TOKEN = os.environ.get('JIRA_API_TOKEN')
The code reads Jira credential values from the environment for Basic authentication. This is expected, but it handles sensitive account access material.
Low
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(`${JIRA_BASE_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY;
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY;
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable access (dot notation)
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable access (dot notation)
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Environment variable object
const JIRA_BASE_URL = process.env.JIRA_BASE_URL;
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Environment variable object
const PROJECT_KEY = process.env.JIRA_PROJECT_KEY || 'SCRUM';
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Python environment access
JIRA_BASE_URL = os.environ.get('JIRA_BASE_URL')
The code reads the Jira base URL from the environment and later sends authenticated requests to that destination. This is configuration, but it affects credential exposure boundaries.
Low
Python environment access
PROJECT_KEY = os.environ.get('JIRA_PROJECT_KEY', 'SCRUM')
The project key is not secret, but it controls which Jira project receives write operations. Misconfiguration can direct automation to the wrong project.
Low
Fetch API call
const projectInfo = await fetch(`${JIRA_URL}/rest/api/3/project/${PROJECT_KEY}`, { headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const epicResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const storyResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const storyResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const subtaskResponse = await fetch(`${JIRA_URL}/rest/api/3/issue`, {
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(`${JIRA_URL}/rest/api/3/field`, { headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const searchResponse = await fetch(
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Low
Fetch API call
const response = await fetch(url, { ...options, headers });
The skill documents authenticated Jira REST calls as part of its intended workflow. This is legitimate functionality but still a real external network side effect.
Risk Factors
⚙️ External commands (207)
jira-workflow/SKILL.md:11 jira-workflow/SKILL.md:12 jira-workflow/SKILL.md:13 jira-workflow/SKILL.md:14 jira-workflow/SKILL.md:15 jira-workflow/SKILL.md:17 jira-workflow/SKILL.md:31-37 jira-workflow/SKILL.md:37-41 jira-workflow/SKILL.md:41-42 jira-workflow/SKILL.md:42-50 jira-workflow/SKILL.md:50-64 jira-workflow/SKILL.md:64-74 jira-workflow/SKILL.md:74-77 jira-workflow/SKILL.md:77-79 jira-workflow/SKILL.md:79-101 jira-workflow/SKILL.md:101-109 jira-workflow/SKILL.md:109-137 jira-workflow/SKILL.md:137-145 jira-workflow/SKILL.md:145-151 jira-workflow/SKILL.md:151-153 jira-workflow/SKILL.md:153-174 jira-workflow/SKILL.md:174-182 jira-workflow/SKILL.md:182-186 jira-workflow/SKILL.md:186-209 jira-workflow/SKILL.md:209-217 jira-workflow/SKILL.md:217-226 jira-workflow/SKILL.md:226-230 jira-workflow/SKILL.md:230-256 jira-workflow/SKILL.md:256-261 jira-workflow/SKILL.md:261-262 jira-workflow/SKILL.md:262-263 jira-workflow/SKILL.md:263-278 jira-workflow/SKILL.md:278-300 jira-workflow/SKILL.md:300-308 jira-workflow/SKILL.md:308-311 jira-workflow/SKILL.md:311-316 jira-workflow/SKILL.md:316-322 jira-workflow/SKILL.md:322-326 jira-workflow/SKILL.md:326-338 jira-workflow/SKILL.md:338-339 jira-workflow/SKILL.md:339-340 jira-workflow/SKILL.md:340-345 jira-workflow/SKILL.md:345-355 jira-workflow/SKILL.md:355-358 jira-workflow/SKILL.md:358-361 jira-workflow/SKILL.md:361-365 jira-workflow/SKILL.md:365-369 jira-workflow/SKILL.md:369-375 jira-workflow/SKILL.md:375-381 jira-workflow/SKILL.md:381-387 jira-workflow/SKILL.md:387-389 jira-workflow/SKILL.md:389-397 jira-workflow/SKILL.md:397-413 jira-workflow/SKILL.md:413-422 jira-workflow/SKILL.md:422-425 jira-workflow/SKILL.md:425-428 jira-workflow/SKILL.md:428-432 jira-workflow/SKILL.md:432-436 jira-workflow/SKILL.md:436-475 jira-workflow/SKILL.md:475-485 jira-workflow/SKILL.md:485-493 jira-workflow/SKILL.md:493-508 jira-workflow/SKILL.md:508-528 jira-workflow/SKILL.md:528-538 jira-workflow/SKILL.md:538-551 jira-workflow/SKILL.md:551-555 jira-workflow/SKILL.md:555-580 jira-workflow/SKILL.md:580-604 jira-workflow/SKILL.md:604-605 jira-workflow/SKILL.md:605-606 jira-workflow/SKILL.md:606-607 jira-workflow/SKILL.md:607-608 jira-workflow/SKILL.md:608-609 jira-workflow/SKILL.md:609-610 jira-workflow/SKILL.md:610-611 jira-workflow/SKILL.md:611-623 jira-workflow/SKILL.md:623-628 jira-workflow/SKILL.md:628-647 jira-workflow/SKILL.md:647-657 jira-workflow/SKILL.md:657-665 jira-workflow/SKILL.md:665-669 jira-workflow/SKILL.md:669-683 jira-workflow/SKILL.md:683-689 jira-workflow/SKILL.md:689 jira-workflow/SKILL.md:690 jira-workflow/SKILL.md:691 jira-workflow/SKILL.md:692 scripts/add-subtasks.mjs:20 scripts/add-subtasks.mjs:23 scripts/add-subtasks.mjs:34 scripts/add-subtasks.mjs:52 scripts/add-subtasks.mjs:60 scripts/add-subtasks.mjs:80 scripts/add-subtasks.mjs:88 scripts/add-subtasks.mjs:108 scripts/add-subtasks.mjs:119 scripts/add-subtasks.mjs:125 scripts/add-subtasks.mjs:128 scripts/add-subtasks.mjs:137 scripts/add-subtasks.mjs:138 scripts/add-subtasks.mjs:139 scripts/add-subtasks.mjs:140 scripts/add-subtasks.mjs:152 scripts/add-subtasks.mjs:156 scripts/add-subtasks.mjs:160 scripts/add-subtasks.mjs:161 scripts/add-subtasks.mjs:165 scripts/add-subtasks.mjs:169 scripts/add-subtasks.mjs:172 scripts/add-subtasks.mjs:181 scripts/add-subtasks.mjs:182 scripts/add-subtasks.mjs:183 scripts/add-subtasks.mjs:184 scripts/create-mvp.mjs:18 scripts/create-mvp.mjs:21 scripts/create-mvp.mjs:31 scripts/create-mvp.mjs:36 scripts/create-mvp.mjs:729 scripts/create-mvp.mjs:730 scripts/create-mvp.mjs:732 scripts/create-mvp.mjs:760 scripts/create-mvp.mjs:761 scripts/create-mvp.mjs:776 scripts/create-mvp.mjs:780 scripts/create-mvp.mjs:789 scripts/create-mvp.mjs:790 scripts/create-mvp.mjs:799 scripts/create-mvp.mjs:800 scripts/create-mvp.mjs:801 scripts/create-mvp.mjs:804 scripts/create-mvp.mjs:805 scripts/create-mvp.mjs:816 scripts/create-mvp.mjs:822 scripts/create-mvp.mjs:823 scripts/create-mvp.mjs:824 scripts/create-two-level.mjs:19 scripts/create-two-level.mjs:21 scripts/create-two-level.mjs:61 scripts/create-two-level.mjs:69 scripts/create-two-level.mjs:486 scripts/create-two-level.mjs:497 scripts/create-two-level.mjs:514 scripts/create-two-level.mjs:530 scripts/create-two-level.mjs:533 scripts/create-two-level.mjs:541 scripts/create-two-level.mjs:547 scripts/create-two-level.mjs:555 scripts/create-two-level.mjs:556 scripts/create-two-level.mjs:557 scripts/create-two-level.mjs:561 scripts/create-two-level.mjs:563 scripts/create-two-level.mjs:567 scripts/create-two-level.mjs:568 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:30-31 SKILL.md:31-34 SKILL.md:34-38 SKILL.md:38-44 SKILL.md:44-50 SKILL.md:50-98 SKILL.md:98-102 SKILL.md:102-189 SKILL.md:189-193 SKILL.md:193-205 SKILL.md:205-211 SKILL.md:211-214 SKILL.md:214 SKILL.md:220-228 SKILL.md:228-232 SKILL.md:232-242 SKILL.md:242-250 SKILL.md:250-256 SKILL.md:256-264 SKILL.md:264-268 SKILL.md:268-271 SKILL.md:271 SKILL.md:284-291 SKILL.md:291-299 SKILL.md:299-321 SKILL.md:321-327 SKILL.md:327-329 SKILL.md:329-339 SKILL.md:339-343 SKILL.md:343-346 SKILL.md:346-348 SKILL.md:348-355 SKILL.md:355-359 SKILL.md:359-365 SKILL.md:365-370 SKILL.md:370-371 SKILL.md:371-382 SKILL.md:382-386 SKILL.md:386-389 SKILL.md:389-395 SKILL.md:395-401 SKILL.md:401-402 SKILL.md:402-409 SKILL.md:409-410 SKILL.md:410-417 SKILL.md:417-418 SKILL.md:418-419 SKILL.md:419-431 SKILL.md:431-437 SKILL.md:437-443
🌐 Network access (39)
jira-workflow/SKILL.md:174 jira-workflow/SKILL.md:209 jira-workflow/SKILL.md:310 jira-workflow/SKILL.md:344 jira-workflow/SKILL.md:412 jira-workflow/SKILL.md:474 jira-workflow/SKILL.md:34 jira-workflow/SKILL.md:698 jira-workflow/SKILL.md:699 jira-workflow/SKILL.md:700 jira-workflow/SKILL.md:701 scripts/add-subtasks.mjs:44 scripts/add-subtasks.mjs:72 scripts/add-subtasks.mjs:89 scripts/add-subtasks.py:61 scripts/add-subtasks.py:86 scripts/add-subtasks.py:100 scripts/add-subtasks.py:106 scripts/add-subtasks.py:21 scripts/create-mvp.mjs:32 scripts/create-mvp.py:62 scripts/create-mvp.py:122 scripts/create-mvp.py:18 scripts/create-two-level.mjs:61 scripts/create-two-level.py:54 scripts/create-two-level.py:110 scripts/create-two-level.py:14 SKILL.md:31 SKILL.md:220 SKILL.md:242 SKILL.md:284 SKILL.md:299 SKILL.md:329 SKILL.md:347 SKILL.md:355 SKILL.md:433 SKILL.md:447 SKILL.md:448 SKILL.md:449
🔑 Env variables (47)
jira-workflow/SKILL.md:146 jira-workflow/SKILL.md:147 jira-workflow/SKILL.md:148 jira-workflow/SKILL.md:149 jira-workflow/SKILL.md:146 jira-workflow/SKILL.md:147 jira-workflow/SKILL.md:148 jira-workflow/SKILL.md:149 scripts/add-subtasks.mjs:7 scripts/add-subtasks.mjs:8 scripts/add-subtasks.mjs:9 scripts/add-subtasks.mjs:10 scripts/add-subtasks.mjs:7 scripts/add-subtasks.mjs:8 scripts/add-subtasks.mjs:9 scripts/add-subtasks.mjs:10 scripts/add-subtasks.py:33 scripts/add-subtasks.py:38 scripts/add-subtasks.py:39 scripts/add-subtasks.py:40 scripts/add-subtasks.py:41 scripts/create-mvp.mjs:5 scripts/create-mvp.mjs:6 scripts/create-mvp.mjs:7 scripts/create-mvp.mjs:8 scripts/create-mvp.mjs:5 scripts/create-mvp.mjs:6 scripts/create-mvp.mjs:7 scripts/create-mvp.mjs:8 scripts/create-mvp.py:30 scripts/create-mvp.py:35 scripts/create-mvp.py:36 scripts/create-mvp.py:37 scripts/create-mvp.py:38 scripts/create-two-level.mjs:6 scripts/create-two-level.mjs:7 scripts/create-two-level.mjs:8 scripts/create-two-level.mjs:9 scripts/create-two-level.mjs:6 scripts/create-two-level.mjs:7 scripts/create-two-level.mjs:8 scripts/create-two-level.mjs:9 scripts/create-two-level.py:26 scripts/create-two-level.py:31 scripts/create-two-level.py:32 scripts/create-two-level.py:33 scripts/create-two-level.py:34
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/01000001-01001110-jira-safe?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/01000001-01001110-jira-safe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/01000001-01001110-jira-safe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/01000001-01001110-jira-safe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
01000001-01001110. (2026). jira-safe security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11BibTeX citation
@techreport{01000001-01001110-01000001-01001110-jira-safe-2026,
author = {01000001-01001110},
title = {jira-safe security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "jira-safe security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "01000001-01001110"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/01000001-01001110-jira-safe/audits/11"
identifiers:
- type: other
value: "skillstore:01000001-01001110-jira-safe:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
73
Community
83
Spec Compliance
What You Can Build
Create a SAFe Backlog
Turn product requirements into Jira epics, stories, acceptance criteria, and subtasks.
Prepare Sprint Work
Break approved features into implementation stories and technical subtasks before sprint planning.
Sync Work Status
Use Jira workflow transition patterns to move issues through Progressing, review, and Done states.
Try These Prompts
Draft One Story
Create one SAFe user story for this feature. Include summary, persona, goal, benefit, acceptance criteria, and subtasks.
Create an Epic Plan
Turn this product goal into one Jira epic with business outcome, success metrics, stories, and implementation subtasks.
Prepare Jira Creation Steps
Prepare the Jira issue creation plan for a team-managed project. Show the parent links and confirm before any write operation.
Review Workflow Automation
Review this Jira workflow automation plan for safety, project field compatibility, rate limits, and rollback steps before execution.
Best Practices
- Confirm project type and available transitions before creating or moving Jira issues.
- Use least-privilege Jira API tokens and test scripts in a sandbox project first.
- Ask for user approval before any Jira write, delete, or bulk operation.
Avoid
- Running demo scripts against production Jira without reviewing the generated backlog.
- Assuming custom field IDs are identical across Jira projects.
- Using bulk delete helpers without a dry run, allowlist, and typed confirmation.
Frequently Asked Questions
Does this skill work with team-managed Jira projects?
Yes. The examples focus on team-managed projects and use the parent field for epic and story hierarchy.
Does it require Jira credentials?
Yes. Scripts and API examples require Jira email, API token, base URL, and project key values.
Can it create real Jira issues?
Yes. The included scripts can create epics, stories, and subtasks when executed with valid credentials.
Can it update workflow states?
Yes. The workflow guidance shows how to query transitions and move issues between configured Jira states.
Is it safe for production Jira projects?
Use caution. Review generated work, use least-privilege tokens, and prefer dry-run or sandbox testing before production writes.
Does it handle custom Jira fields automatically?
Partly. It explains common fields and includes lookup guidance, but each Jira instance may need validation.
Developer Details
Author
01000001-01001110License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
7ed2830f0283f3a8900137d8dc893e54072206f3
Maintenance freshness
7/18/2026
Usage
83 downloads · 405 views
File structure