JFrog Access
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the automatic installation of the official
jfCLI tool when it is missing from the system. - [COMMAND_EXECUTION]: The skill relies on shell command execution via
jfandcurlfor all administrative platform operations. - [CREDENTIALS_UNSAFE]: A hardcoded example password 'securePass123!' is included in a JSON body example within the
api-reference.mdfile. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes user-provided strings for user, group, and permission management without explicit validation.
- Ingestion points: User-provided fields in JSON payloads for API requests.
- Boundary markers: No specific delimiters or safety warnings are included in the instructions.
- Capability inventory: Shell command execution using
jfandcurlfor resource modification. - Sanitization: No data sanitization or escaping mechanisms are described.
Audit Metadata