jfrog-init
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Node.js Version Manager (nvm) installation script from the well-known nvm-sh repository on GitHub and the JFrog CLI binary from the official releases.jfrog.io domain.- [REMOTE_CODE_EXECUTION]: The initialization workflow executes downloaded installation scripts and binaries to configure the runtime environment and command-line tools.- [COMMAND_EXECUTION]: The skill invokes Node.js scripts to perform read-only health checks, connectivity tests, and configuration discovery across the JFrog platform.- [CREDENTIALS_UNSAFE]: As part of the Claude Code marketplace registration, the skill writes access tokens to the standard ~/.netrc file to facilitate authenticated network requests by CLI tools.- [COMMAND_EXECUTION]: The setup process includes idempotent modifications to user shell profiles (e.g., .bashrc, .zshrc) to add the JFrog CLI directory to the system PATH.- [SAFE]: All identified activities, including network communication with vendor APIs and local configuration updates, are consistent with the skill's primary purpose of environment setup and utilize trusted infrastructure.
Audit Metadata