by 安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to implement the advertised Jira REST operations, but the package metadata omits that it reads local credential/config files (~/.netrc and ~/.config/.jira/.config.yml), which is an important discrepancy you should understand before installing.
评估建议
This skill is coherent with Jira automation and the Python script implements expected REST calls. However, before installing or running it note that:
- The script reads your Jira server/login from ~/.config/.jira/.config.yml and your API token from ~/.netrc. The registry metadata incorrectly states no required config paths — verify and be comfortable with these file accesses.
- Use a dedicated Atlassian API token with minimal permissions (not your main account password). Consider creating a to...详细分析 ▾
ℹ 用途与能力
The skill's code and documentation align with its stated purpose (Jira Cloud REST operations: JQL, worklogs, sprints, raw REST). However, the registry metadata claims 'Required config paths: none' while the included script explicitly reads ~/.config/.jira/.config.yml and ~/.netrc to obtain the Jira server, login and API token — a mismatch between declared requirements and actual behavior.
✓ 指令范围
SKILL.md instructs the agent to use the script for Jira REST calls and explicitly tells users to authenticate via ~/.netrc and to avoid pasting tokens in chat. The instructions stay within the Jira automation scope and do not request unrelated system data or external endpoints.
✓ 安装机制
There is no install spec (instruction-only + bundled script). That is low-risk in that nothing is automatically downloaded or executed from remote sources. The included Python script has no external dependencies and will run locally.
⚠ 凭证需求
The skill accesses local credential/config files (~/.netrc and ~/.config/.jira/.config.yml) to read your Jira token and server. Access to those files is proportionate to the stated Jira automation purpose, but the metadata did not declare these required config paths or a primary credential — an important omission. The script does not require unrelated environment variables, and there is no evidence it requests unrelated credentials.
✓ 持久化与权限
The skill is not always-enabled, does not request elevated platform privileges, and does not modify other skills' configuration. It will act only when invoked.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/18
Initial release: Jira Cloud REST API helper. Covers issues, comments, transitions, assign/link; worklogs add/update/delete; boards/sprints via Agile API; JQL via /search/jql.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install jira-api-rest
镜像加速npx clawhub@latest install jira-api-rest --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制