JFrog CLI
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the JFrog CLI using a remote shell script via
curl -fL https://install-cli.jfrog.io | sh. This is a vendor-provided installation method from the officialjfrog.iodomain. - [COMMAND_EXECUTION]: Extensive use of shell commands to wrap the
jfCLI tool, including complex pipelines for artifact management, build publication, and security auditing. It also uses inline Python scripts for robust JSON parsing of CLI outputs. - [CREDENTIALS_UNSAFE]: The skill manages JFrog Platform access tokens. It uses the CLI's native
jf configsystem, which encrypts credentials at rest. The login flow includes explicit security instructions to avoid logging or printing tokens and uses transient shell variables for session-based authentication fallback. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from Artifactory (such as artifact metadata, search results, and API responses) which could potentially contain malicious instructions if the JFrog instance is compromised. This is mitigated by the skill's focus on structured JSON processing and vendor-recommended validation steps.
Audit Metadata