jfrog-setup-package-managers
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
jfCLI and a local helper script,merge-workspace-binding.sh, to manage Artifactory configuration and workspace repository bindings. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes local workspace manifests (e.g.,
package.json,requirements.txt) to determine the appropriate package managers to configure. This behavior is the primary purpose of the skill and includes input validation in the provided scripts. - Ingestion points: Reads local project manifest files to detect package manager types.
- Boundary markers: Relies on user intent to perform setup on identified manifests; manifest content is processed as data.
- Capability inventory: Executes vendor-provided CLI tools and local shell scripts; writes configuration to the workspace directory.
- Sanitization: Employs strict regex validation for repository keys in the
merge-workspace-binding.shscript.
Audit Metadata