jira-update
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script automates the launch of a Chromium-based browser (such as Chrome, Brave, or Edge) to handle Atlassian SSO. It uses the
node:child_processspawn method to start the browser process with specific debugging flags (--remote-debugging-port,--user-data-dir) to enable programmatic interaction via the Chrome DevTools Protocol (CDP). - [DATA_EXFILTRATION]: The skill uses CDP commands (
Network.getCookies) to programmatically retrieve authentication cookies from the browser session. These cookies are subsequently used to authenticate REST API calls to the user-specified Jira server. The cookie extraction logic is scoped specifically to the target Jira host provided in the configuration. - [SAFE]: The skill implements several security best practices, including a default dry-run mode where no writes occur to Jira unless the
--applyflag is explicitly provided. It also maintains a transparent audit trail in a local directory (raw/jira-updates/), storing the exact JSON payloads and issue states for review before and after execution.
Audit Metadata