skills/openhands/extensions/jira-issue-to-pr/Socket

jira-issue-to-pr

Warn

Audited by Socket on Jul 25, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill’s purpose matches its Jira-to-GitHub automation behavior, and there is no obvious malicious installer or third-party credential sink. However, it enables autonomous PR creation and Jira commenting from untrusted ticket content, with repo selection taken from the ticket body and powerful inherited agent/GitHub access, making it a high-impact automation with meaningful abuse risk.

Confidence: 87%Severity: 74%

Audit Metadata

Analyzed At

Jul 25, 2026, 01:43 PM

Package URL

pkg:socket/skills-sh/openhands%2Fskills%2Fjira-issue-to-pr%2F@8cae7680d14efaf8c7e2de3dbfcfd570cfb1474164e10c651d0a4cf5dbf42144