jenkins-agent-l3-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill requires the Jenkins agent user to have
sudo NOPASSWDpermissions and membership in thedockergroup. This is a standard requirement for deployment agents that need to manage system-level Docker containers and filesystem permissions. - [COMMAND_EXECUTION]: The Jenkins pipeline template executes several shell commands (
shsteps) and a Python deployment script (deploy.py) with elevated privileges to orchestrate the application stack. - [EXTERNAL_DOWNLOADS]: Setup instructions involve downloading the official Jenkins
agent.jarfrom a user-specified controller URL and installing the OpenJDK package viaapt-get. - [CREDENTIALS_UNSAFE]: The skill manages sensitive credentials by writing them to memory-backed temporary filesystems (
/dev/shmand/run/payroll-sec) using the JenkinswithCredentialswrapper. It includes a mitigation step usingshredto securely remove sensitive bundle files after the deployment stage finishes.
Audit Metadata