jfrog-curation-onboarding
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill performs administrative operations via the JFrog CLI (jf) and curl to configure the platform. It correctly utilizes jq for safe JSON payload construction from user inputs, such as notification emails, which effectively prevents command injection vulnerabilities.
- [DATA_EXFILTRATION]: Network communication is restricted to the user-defined JFrog Platform URL (JFROG_URL). Data retrieved during the process, including repository metadata and policy status, is used strictly for the local onboarding workflow and is not sent to any unauthorized third-party services.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys or secrets are present in the skill. It follows secure practices by loading configuration and credentials from the environment or a local .env file, ensuring sensitive information remains under the user's control.
- [EXTERNAL_DOWNLOADS]: The skill does not perform any remote code execution or download external scripts from the internet. All logic is executed through documented shell commands and pre-installed system utilities.
Audit Metadata