安全扫描
OpenClaw
安全
high confidenceThe skill's requirements and instructions line up with its stated purpose (Jira ticket read/update) and it only asks for standard Jira credentials; nothing looks deliberately deceptive or unrelated.
评估建议
This skill appears to do what it says: read and update Jira issues. Before installing or enabling it, verify the following: 1) Only provide a Jira API token scoped with the minimum permissions needed (prefer read or limited write scopes), store it in a secrets manager or env var, and rotate it if exposed. 2) If you plan to use the MCP path, confirm you trust the 'uvx' tool and the 'mcp-atlassian' package source before installing—the SKILL.md recommends installation but the registry metadata does...详细分析 ▾
ℹ 用途与能力
Name/description match the requested environment variables (JIRA_URL, JIRA_EMAIL, JIRA_API_TOKEN) and the described capabilities (search, fetch, update, transition). Minor inconsistency: SKILL.md recommends installing an MCP client via the 'uvx' tool, but the skill metadata does not declare 'uvx' as a required binary or provide an install spec.
✓ 指令范围
SKILL.md only instructs the agent to interact with Jira (via MCP tooling or direct REST API) and to use the declared environment variables. It does not ask the agent to read unrelated files, exfiltrate data to third parties, or access system paths outside the Jira integration context.
ℹ 安装机制
This is an instruction-only skill with no install spec or shipped code (lowest disk risk). It suggests using 'uvx' to install 'mcp-atlassian==0.21.0' but does not provide an install specification or provenance for that package; if you choose MCP, verify the uvx tool and package source before installing.
✓ 凭证需求
The three required environment variables (JIRA_URL, JIRA_EMAIL, JIRA_API_TOKEN) are appropriate and expected for a Jira integration. They are sensitive credentials, so least-privilege token scopes and secret storage are advised (the SKILL.md already recommends not hardcoding tokens).
✓ 持久化与权限
The skill does not request persistent system presence (always: false), does not modify other skills' configurations, and has no config-path requirements. It is user-invocable and may be called autonomously by the agent (platform default) but that is not unusual for skills.
安全有层次,运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS · Windows
版本
latestv1.0.02026/4/5
Initial release. Jira ticket retrieval, analysis, and updates via MCP or REST API. Adapted from everything-claude-code by @affaan-m (MIT)
● 无害
安装命令 点击复制
官方npx clawhub@latest install jira-ops
镜像加速npx clawhub@latest install jira-ops --registry https://cn.clawhub-mirror.com
技能文档
Retrieve, analyze, and update Jira tickets with MCP or direct REST API.
When to Activate
- Fetching ticket requirements and acceptance criteria
- Adding progress comments or status updates
- Transitioning ticket status (To Do → In Progress → Done)
- Searching for issues via JQL queries
- Linking PRs or branches to tickets
Setup
Option A: MCP Server (Recommended)
Install mcp-atlassian via uvx:
{
"jira": {
"command": "uvx",
"args": ["mcp-atlassian==0.21.0"],
"env": {
"JIRA_URL": "https://YOUR_ORG.atlassian.net",
"JIRA_EMAIL": "your.email@example.com",
"JIRA_API_TOKEN": "your-api-token"
}
}
}
Get your API token: https://id.atlassian.com/manage-profile/security/api-tokens
Option B: Direct REST API
Set these environment variables:
JIRA_URL— Jira instance URLJIRA_EMAIL— Your account emailJIRA_API_TOKEN— API token (never hardcode)
MCP Tools
With mcp-atlassian configured:
jira_search— JQL queriesjira_get_issue— Fetch issue detailsjira_create_issue— Create new issuesjira_update_issue— Update fieldsjira_transition_issue— Change statusjira_add_comment— Add commentsjira_get_transitions— List available transitions
Analyzing Tickets
Extract from tickets:
- Functional requirements — What needs to be built
- Acceptance criteria — Testable conditions
- Test types — Unit, integration, E2E
- Edge cases — Error scenarios, boundary conditions
- Dependencies — Linked issues, APIs, systems
Updating Tickets
| Workflow | Jira Action |
|---|---|
| Start work | Transition to "In Progress" + comment branch name |
| Tests done | Comment with test coverage summary |
| PR created | Comment with link, transition if needed |
| Merged | Transition to "Done" |
Security
- Never hardcode API tokens
- Use environment variables or secrets manager
- Add
.envto.gitignore - Rotate tokens if exposed
- Use least-privilege scopes
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制