jira

SUSPICIOUS: The Jira functionality itself is coherent and mostly well-scoped, but the skill’s default fallback is to install another skill from a third-party GitHub repo, creating a transitive trust and supply-chain risk that does not need to be embedded in a Jira workflow skill. No direct credential theft or exfiltration is shown, so this is not confirmed malware, but the install/delegation behavior materially raises security risk.