jenkinsfile-validator
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a legitimate security auditor for Jenkins pipeline files using local static analysis.
- [SAFE]: Validation is performed using local shell scripts; no remote code execution or external downloads occur during analysis.
- [SAFE]: Dummy credentials in example files are used solely for testing detection capabilities and do not represent a security risk.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection (Category 8) as it processes user-provided Jenkinsfiles and performs web searches for unrecognized plugins.
- Ingestion points: Jenkinsfiles are read and processed by
scripts/validate_jenkinsfile.shand associated scripts. - Boundary markers: Absent; user-provided file content is not delimited from agent instructions.
- Capability inventory: Local script execution (bash), WebSearch, and Context7 MCP usage.
- Sanitization: None; the tool reports raw results of static analysis to the agent context.
Audit Metadata