jenkins-pipelines
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates Jenkinsfiles that utilize the
shstep to execute various command-line tools including npm, helm, psql, and ssh. This is the intended primary purpose of the skill to facilitate automation and orchestration.- [PRIVILEGE_ESCALATION]: The skill contains templates for Kubernetes agents (Section 4) that usesecurityContext: { privileged: true }to enable Docker-in-Docker functionality. It also includes examples of mounting host paths (-v $HOME/.npm:/root/.npm). While common in build environments, these configurations grant the execution environment significant privileges on the underlying host.- [INDIRECT_PROMPT_INJECTION]: The skill acts as a code generator for complex build pipelines based on user specifications. This creates an attack surface where untrusted data could influence generated code. - Ingestion points: User instructions for pipeline customization (e.g., service names, branch patterns) in SKILL.md.
- Boundary markers: None identified in the provided templates.
- Capability inventory: Generated scripts can execute arbitrary shell commands via the
shstep across all examples. - Sanitization: The skill uses direct interpolation of variables into shell scripts (e.g., helm commands) without explicit sanitization logic.
Audit Metadata