The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @jfrog/agent-guard utility from the official JFrog Artifactory NPM registry. This tool is used for discovering available skills and plugins and provisioning repositories within the AI Catalog.
[COMMAND_EXECUTION]: Employs the jf CLI and a bundled Node.js script (list-skill-policies.mjs) to interact with JFrog services. The bundled script is written with security in mind, using spawnSync without a shell and proper URI encoding to prevent argument or command injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external metadata and policy descriptions from the AI Catalog. To mitigate prompt injection risks, it uses rigid response templates, structured Markdown tables for data presentation, and a dedicated sanitization function in its policy script to scrub internal service names and diagnostic Trace IDs from the output.
[DATA_EXPOSURE]: The skill accesses the local ~/.jfrog/setup.json file to identify the active project context. It explicitly warns the agent against reading more sensitive files like jfrog-cli.conf.v6, which may contain authentication tokens, demonstrating a proactive stance on credential protection.

jfrog-ai-catalog