# Jira Cve Tracker

> Query a Jira project for open CVE Vulnerability issues, deduplicate across container variants, cluster by due date, and estimate release dates. Use this skill when the user asks about CVE status, which CVEs are blocking a release, when the next Z-stream should ship, or whether a specific CVE has an open Jira card.

- **Type:** Skill
- **Install:** `agentstack add skill-aipcc-cicd-claudio-skills-jira-cve-tracker`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [aipcc-cicd](https://agentstack.voostack.com/s/aipcc-cicd)
- **Installs:** 0
- **Category:** [Productivity](https://agentstack.voostack.com/c/productivity)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [aipcc-cicd](https://github.com/aipcc-cicd)
- **Source:** https://github.com/aipcc-cicd/claudio-skills/tree/main/claudio-plugin/skills/jira-cve-tracker

## Install

```sh
agentstack add skill-aipcc-cicd-claudio-skills-jira-cve-tracker
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Jira CVE Tracker

Queries a Jira project for open Vulnerability issues, deduplicates across container variants (one CVE = multiple issues per arch/variant), and estimates release dates based on SLA due dates.

## Prerequisites

**Required environment variables:**
- `JIRA_SITE` — Atlassian site (e.g. `yourorg.atlassian.net`)
- `JIRA_TOKEN` — Atlassian API token
- `JIRA_EMAIL` — Your Atlassian account email

**Required tools:** `jq`, `curl`

## Key Concepts

- **CVE deduplication** — one CVE ID typically maps to 3–10 Jira issues (one per container variant/architecture). The tracker deduplicates by CVE ID before counting.
- **`fixVersion`** — used to group CVEs by target release (e.g. `3.3.1`, `3.3.2`). More reliable than `affectedVersion` for filtering.
- **`duedate`** — SLA deadline by which the CVE must be fixed and shipped.
- **Clustering** — CVEs with no fix version are grouped into date clusters based on their due dates, using a configurable day window.

## Scripts

### `estimate_release.sh` — CVE-based release date estimation

```bash
./scripts/estimate_release.sh --project KEY [options]
```

**Options:**
- `--project KEY` — Jira project key to query (required)
- `--fix-version VERSION` — filter to a specific fix version
- `--cluster-days N` — day window for grouping unassigned issues (default: `14`)
- `--format table|json` — output format (default: `table`)
- `--verbose` — show individual CVE IDs per group

**Examples:**
```bash
# Full overview: all open CVEs grouped by fix version + unassigned clusters
./scripts/estimate_release.sh --project MYPROJ

# CVEs targeting a specific fix version
./scripts/estimate_release.sh --project MYPROJ --fix-version "3.3.1"

# Tighter clustering, verbose
./scripts/estimate_release.sh --project MYPROJ --cluster-days 7 --verbose

# JSON for programmatic processing
./scripts/estimate_release.sh --project MYPROJ --format json | jq '.[] | select(.overdue)'
```

**Output columns:**
- `Fix Version / Cluster` — fix version name or `Unassigned ~YYYY-MM` date cluster
- `CVEs` — deduplicated CVE count
- `Issues` — total raw issue count (includes per-variant duplicates)
- `Earliest Due` / `Latest Due` — SLA date range
- `Statuses` — breakdown of issue statuses within group

---

### `check_cves.sh` — Check specific CVEs against a project

```bash
./scripts/check_cves.sh --project KEY CVE-2026-1234 [CVE-2025-9999 ...]
echo "CVE-2026-1234" | ./scripts/check_cves.sh --project KEY
```

Output: one line per CVE:
```text
OPEN    | CVE-2026-1234 | PROJ-101,PROJ-102
NO_CARD | CVE-2025-9999
```

Useful for bulk-checking a list of CVEs from a security advisory.

---

### `cve_tracker.sh` — General-purpose CVE query engine

Low-level script used by `estimate_release.sh`. Can query any Jira project.

```bash
./scripts/cve_tracker.sh  [options]
```

**Options:**
- `--filter SUBSTR` — case-insensitive substring filter on issue summary
- `--issue-type TYPE` — issue type to query (default: `Vulnerability`)
- `--status open|all` — `open` excludes Closed issues (default)
- `--cluster-days N` — day window for grouping unassigned issues (default: 14)
- `--format table|json` — output format (default: `table`)
- `--verbose` — show individual CVE IDs per group (table mode)

Uses the Jira REST API directly (`POST /rest/api/3/search/jql`) because `acli --fields` rejects `duedate` and `fixVersions`. All analysis is performed with an embedded `jq` script.

---

### `cve_bulk_check.sh` — Low-level CVE lookup

Low-level script used by `check_cves.sh`. Searches Vulnerability issues in any project.

```bash
./scripts/cve_bulk_check.sh --project KEY CVE-2026-1234 [...]
echo "CVE-2026-1234" | ./scripts/cve_bulk_check.sh --project KEY
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aipcc-cicd](https://github.com/aipcc-cicd)
- **Source:** [aipcc-cicd/claudio-skills](https://github.com/aipcc-cicd/claudio-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aipcc-cicd-claudio-skills-jira-cve-tracker
- Seller: https://agentstack.voostack.com/s/aipcc-cicd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.