jenkins-agent-l3-deploy
Fail
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly instructs the user to configure the Jenkins agent process with 'sudo NOPASSWD'. This privilege escalation vulnerability allows any code executed by the agent (orchestrated by the Jenkins controller) to run with full root permissions on the host system without further authentication.
- [REMOTE_CODE_EXECUTION]: The setup workflow involves downloading a Java archive ('agent.jar') from a remote Jenkins controller ('http://:8080') and executing it locally. This constitutes remote code execution from an unverified external source.
- [CREDENTIALS_UNSAFE]: The setup instructions include passing the agent's authentication secret as a command-line argument ('-secret <AGENT_SECRET>'). This is a dangerous practice as command-line arguments are often visible in process lists (e.g., via 'ps'), shell history files, and system logs.
- [EXTERNAL_DOWNLOADS]: The skill uses 'curl' to download the Jenkins agent binary and 'apt-get' to install the OpenJDK 21 runtime from external repositories. While these are common administrative tasks, they introduce external dependencies into the deployment environment.
- [COMMAND_EXECUTION]: The deployment pipeline executes multiple shell commands and scripts with 'sudo', increasing the risk associated with any potential command injection or script compromise.
Recommendations
- AI detected serious security threats
Audit Metadata