jira-integration

SUSPICIOUS. The skill's purpose and API actions are coherent for Jira integration, and the direct REST path is proportionate and points to official Jira endpoints. Risk comes from the recommended MCP path: it installs and entrusts Jira credentials to a third-party community package rather than an Atlassian-official component. No clear exfiltration, stealth, or malware behavior is shown, but the credential-forwarding and third-party execution trust issues make the skill medium/high risk overall.