Trust Assessment
clawhub-jira-pat-skill received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Unsanitized user input leads to command injection in shell script.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unsanitized user input leads to command injection in shell script The `jira-pat.sh` script directly interpolates user-provided arguments (`issue_key`, `jql`, `epic_key`) into `curl` commands without proper sanitization or URL encoding. This allows an attacker to inject arbitrary shell commands by crafting malicious input for these arguments. For example, an `issue_key` like `PROJECT-123; rm -rf /` could lead to the execution of `rm -rf /` on the system running the script. This vulnerability exists in multiple functions including `jira_get`, `jira_summary`, `jira_search`, `jira_children`, `jira_transitions`, `jira_transition`, and `jira_comment`. Implement robust input sanitization and URL encoding for all user-provided arguments before interpolating them into shell commands. For URL path segments, manual encoding or a utility function is required. For query parameters, `curl --data-urlencode` can be used. Alternatively, use a safer HTTP client library if available, or ensure the LLM calling the script performs strict input validation and encoding. | LLM | scripts/jira-pat.sh:17 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/dejanb/clawhub-jira-pat-skill/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/8594f799d8f16448)
Powered by SkillShield