jira-confluence-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited jira-confluence-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
shrug is a CLI installed on this machine that talks to Atlassian Cloud. It covers three products: Jira (issues, projects, filters, dashboards, search), Jira Software (boards, sprints, epics), and Confluence (spaces, pages, blog posts, whiteboards, databases, folders, custom content, smart links, tasks, search).
Every entity supports some subset of LCRUD verbs: list, create, view, edit, delete. The CLI is consistent across all entities, so once you know the pattern, you can work with any resource.
A shrug profile must already be configured with valid credentials. If commands fail with authentication errors, tell the user to run shrug auth set-token or check shrug profile list. Do not attempt to configure credentials yourself.
shrug [GLOBAL FLAGS] <product> <entity> [sub-entity] <verb> [POSITIONAL] [FLAGS]Products and aliases:
| Product | Alias |
|---|---|
jira | j |
jira-software | jsw |
confluence | c, conf |
Pattern: shrug jira issue list, shrug confluence page view 1001, shrug jsw sprint create --name "Sprint 1" --board 42.
Many entities have sub-entities. For example, jira issue comment, jira issue worklog, confluence page label, confluence page attachment. The sub-entity follows the parent entity and uses the same verb pattern.
Use these with any command.
| Flag | Short | Purpose |
|---|---|---|
--output <FORMAT> | -o | json (machine-readable), table (default, human-readable), csv (export) |
--profile <NAME> | -p | Target a specific Atlassian site profile |
--dry-run | -n | Show the HTTP request without executing it. Use this to preview destructive operations |
--limit <N> | -L | Cap the number of results returned |
--verbose | -v | Increase verbosity. -vv for debug, -vvv for trace |
--web | -w | Open the resource in the browser instead of printing |
--quiet | -q | Suppress non-essential output |
--fields | Select specific fields for table output (e.g. --fields key,summary,status) |
Always use `-o json` when you need to parse output programmatically. Table output is for humans. JSON output gives you structured data you can pipe through jq or parse in scripts.
Always use `--dry-run` before destructive operations (create, edit, delete) if you are unsure of the effect. This shows the exact HTTP request that would be sent.
Always pass `--yes` to delete commands to skip the confirmation prompt, since you cannot interact with interactive prompts.
jira for the issues themselves, jsw for how they are organised into boards and sprints| Entity | Verbs | Notes |
|---|---|---|
issue | LCRUD | Core entity. Supports --jql, --project, --assignee @me, --status, --type for filtering |
issue comment | LCRUD | Markdown body auto-converted to ADF |
issue worklog | LCRUD | Use --time 2h for time tracking |
issue attachment | LCRD | --file <path> to upload |
issue watcher | LCD | --user @me or --user <accountId> |
issue link | LCRD | --from, --to, --type |
issue remote-link | LCRUD | --url, --title |
issue property | LCRD + edit | JSON properties on issues |
project | LCRUD | |
project component | LCRUD | |
project version | LCRUD | |
filter | LCRUD | Saved JQL queries. --jql, --favourite |
dashboard | LCRUD | |
label | L | Read-only list |
audit | L | --from, --to for date range |
search | L | JQL search. --jql or shorthand flags |
| Entity | Verbs | Notes |
|---|---|---|
board | LCRD | --project, --type scrum/kanban. Config via board config <id> |
sprint | LCRUD | --board <id> required for list/create. --state active/closed/future |
epic | view, edit, list | epic list <key> lists issues in epic. --done to mark complete |
| Entity | Verbs | Notes |
|---|---|---|
space | LCRUD | --type global, --status current |
space property | LCRUD | |
page | LCRUD | --space-id for create/list. Body is storage format HTML |
page comment | LCRUD | |
page label | LCD | Positional label name |
page like | view, list | Read-only |
page property | LCRUD | |
page attachment | LCRUD | --file for upload |
page version | view, list | Read-only history |
page restriction | view, edit, delete | Access control |
blogpost | LCRUD | Same sub-entities as page |
whiteboard | CRD | |
database | CRD | |
folder | CRD | |
custom-content | LCRUD | --type "ac:app:content" required |
smart-link | CRD | Positional URL |
task | view, list, edit | edit <id> complete or edit <id> incomplete |
search | L | CQL search. --cql or shorthand --space, --type, --title |
Jira uses JQL (Jira Query Language):
shrug jira search list --jql "project = TEAM AND status = Open"
# Or shorthand:
shrug jira search list --project TEAM --assignee @me --type BugConfluence uses CQL (Confluence Query Language):
shrug confluence search list --cql "type = page AND space = DOCS"
# Or shorthand:
shrug confluence search list --space DOCS --type page --title "Getting Started"For complex creates/edits, generate a template, fill it in, then pass it:
# 1. Generate template
shrug template jira issue create --output-dir .
# 2. Edit the generated jira-issue-create.json
# 3. Use it
shrug jira issue create -s x --project TEAM --type Task --from-json jira-issue-create.jsonTemplate generation supports: jira issue create/edit, jsw board create, jsw sprint create/edit, conf space create/edit, conf page create/edit, conf blogpost create/edit, conf custom-content create/edit.
Use shrug template all --output-dir ./templates to generate all 13 at once.
Create and track an issue:
shrug jira issue create -s "Fix login bug" --project TEAM --type Bug --assignee @me
shrug jira issue comment create TEAM-42 --body "Root cause identified"
shrug jira issue worklog create TEAM-42 --time 2h --body "Implemented fix"Export data:
shrug -o csv jira issue list --project TEAM --fields key,summary,status > issues.csv
shrug -o json confluence page list --space-id 12345 > pages.jsonSprint management:
shrug jira-software sprint list --board 42 --state active
shrug jira-software sprint create --name "Sprint 5" --board 42 --goal "Ship v2"Manage a Confluence page:
shrug confluence page create --title "Design Doc" --space-id 12345 --body "# Overview"
shrug confluence page label create 1001 architecture
shrug confluence page comment create 1001 --body "Reviewed"-o json when you need to extract IDs, keys, or other data from command output. Pipe through jq for field extraction.--dry-run before create/edit/delete if you are unsure about the parameters.TEAM-123. Most other entities use numeric IDs. When you create a resource, capture the ID from the JSON output for subsequent operations.shrug confluence page comment list <page-id>.<p>text</p>. For richer content, use the --from-json approach with a template.--limit to cap results.shrug confluence space list, shrug jira project list, shrug jsw board list.For the complete list of every command with all flags and examples, read references/command-reference.md. Use it when you need exact flag names or syntax for a specific operation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.