jfrog-delete-project
Warn
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using variables such as
${REPO}and${PROJECT_KEY}which are populated directly from external JFrog API responses. This pattern is vulnerable to command injection if an attacker can control entity names within the JFrog platform.\n - Ingestion points: Project keys and repository names fetched via
jf apiorcurl(SKILL.md)\n - Boundary markers: Absent\n
- Capability inventory: Shell execution via
jf api,curl, andjq(SKILL.md)\n - Sanitization: Absent. Variables are used in shell strings without quoting or validation.\n- [COMMAND_EXECUTION]: The script uses the
sourcecommand to load a.envfile. This causes the shell to execute any code contained within that file, posing a risk of arbitrary code execution if the file is compromised or contains untrusted content.\n- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download and install dependencies (curl,jq) usingsudo apt-get install, which requires administrative privileges and is a high-risk operation.
Audit Metadata