JFrog CLI

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the JFrog CLI using a remote shell script via curl -fL https://install-cli.jfrog.io | sh. This is a vendor-provided installation method from the official jfrog.io domain.
  • [COMMAND_EXECUTION]: Extensive use of shell commands to wrap the jf CLI tool, including complex pipelines for artifact management, build publication, and security auditing. It also uses inline Python scripts for robust JSON parsing of CLI outputs.
  • [CREDENTIALS_UNSAFE]: The skill manages JFrog Platform access tokens. It uses the CLI's native jf config system, which encrypts credentials at rest. The login flow includes explicit security instructions to avoid logging or printing tokens and uses transient shell variables for session-based authentication fallback.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from Artifactory (such as artifact metadata, search results, and API responses) which could potentially contain malicious instructions if the JFrog instance is compromised. This is mitigated by the skill's focus on structured JSON processing and vendor-recommended validation steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 03:44 PM