jk

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The doc includes CLI examples that pass API tokens and secrets directly (e.g., --token , --secret "value", echo "secret-value" | ...), which requires the agent to insert secret values verbatim into generated commands/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Jenkins console logs and other job/run text are fetched at runtime from the Jenkins controller (e.g., via jk log --follow / jk run view --summary) and can include outsider-authored content (committers/PR authors), which the CLI then passes as readable output into the agent’s LLM context.