Skill

atlassian-mcp

skill:jeffallan/claude-skills#atlassian-mcp

Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL filters, creating and updating tickets with custom fields, searching or editing Confluence pages with CQL, managing sprints and backlogs, setting up MCP server authentication, syncing documentation, or debugging Atlassian API integrations.

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:21 UTC at 190e05a

findings

medium

highest severity

threat classes

590

files scanned

318/321

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/atlassian-mcp:skills/atlassian-mcp/references/mcp-server-setup.md:47:SUPPLY
suspicious: finding skill:skills/atlassian-mcp:skills/atlassian-mcp/references/mcp-server-setup.md:52:SUPPLY

Security findings 2

Supply chain

mediumContextual riskmedium confidence

The skill's setup guidance instructs the agent to install and run community MCP servers from public registries without version pins (uvx/pip mcp-atlassian, docker tag :latest, npx -y @xuandev/atlassian-mcp, npx -y mcp-remote), executing unpinned remote code that can silently change after publication; this is not itself declared as a supply-chain exposure even though choosing community servers is a declared capability, so it is reported as contextual risk.

skills/atlassian-mcp/references/mcp-server-setup.md:47

docker pull ghcr.io/sooperset/mcp-atlassian:latest

vector:instruction

Counter-argument considered

The referenced setup doc does instruct unpinned, mutable installs of third-party servers (uvx/pip mcp-atlassian, docker :latest) that receive the user's Atlassian tokens; the pinned-official-registry-install carve-out does not apply, no shown claim declares the mutable-execution exposure (D10/D11 declare only running the community server), and the scoping note 'Use these only when the official server does not fit' lowers severity without neutralizing it, so the contextual-risk finding stands.

Supply chain

mediumContextual risklow confidence

The skill's setup documentation instructs running unpinned third-party MCP servers from public registries (npm @xuandev/atlassian-mcp and mcp-remote, PyPI mcp-atlassian), so the code executed at runtime can silently change between invocations; this stays within the declared server-setup purpose, so it is a contextual risk, not an established abuse.

skills/atlassian-mcp/references/mcp-server-setup.md:52

npx -y @xuandev/atlassian-mcp

vector:instruction

Counter-argument considered

Concrete setup commands tell the agent to execute the latest published third-party packages (npx -y @xuandev/atlassian-mcp, npx -y mcp-remote, uvx mcp-atlassian), which is outside the pinned-install carve-out; nothing in the shown claims declares the silent-change supply-chain exposure, and the doc's scoping ('Use these only when the official server does not fit') is a severity mitigant, not a refutation, so the contextual-risk finding survives.

Package advisories 30

Known vulnerabilities and malicious-package reports (OSV) for the packages it installs or runs.

criticalGHSA-wrhw-j3f9-8vc6PyPI/mcp-atlassian

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token