ClawHub
Back to skill

Security audit

Jenkins

Security checks for vulnerabilities and agentic risk

Overview

The Jenkins skill is coherent and not deceptive, but it uses real Jenkins credentials for high-impact CI/CD actions without enough safeguards against misuse or secret exposure.

Review before installing. Use only with a narrowly scoped Jenkins service account, configure JENKINS_URL with HTTPS, avoid passing secrets as build parameters, and require human approval before triggering or stopping production or deployment jobs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/jenkins.mjs:28
Finding

Jenkins credentials may be transmitted over plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/jenkins.mjs, lines 28-47
Vulnerability Type: Transmission of sensitive credentials over a potentially unencrypted connection
Risk Level: High

Vulnerable Code

js
const JENKINS_URL = process.env.JENKINS_URL?.replace(/\/$/, "");
const JENKINS_USER = process.env.JENKINS_USER;
const JENKINS_API_TOKEN = process.env.JENKINS_API_TOKEN;

if (!JENKINS_URL || !JENKINS_USER || !JENKINS_API_TOKEN) {
  console.error("Missing required environment variables: JENKINS_URL, JENKINS_USER, JENKINS_API_TOKEN");
  process.exit(2);
}

const auth = Buffer.from(`${JENKINS_USER}:${JENKINS_API_TOKEN}`).toString("base64");

const headers = {
  "Authorization": `Basic ${auth}`,
  "Content-Type": "application/json",
  "Accept": "application/json",
};

async function request(path, { method = "GET", body = undefined, crumb = false } = {}) {
  const url = `${JENKINS_URL}${path}`;

  const res = await fetch(url, {

Technical Analysis

The application accepts JENKINS_URL without parsing the URL or requiring the HTTPS protocol. It then places the Jenkins username and API token in an HTTP Basic Authentication header on every request.

Basic Authentication uses Base64 encoding, which provides no encryption. If JENKINS_URL is configured with an http:// endpoint, the authorization header and its credentials can be observed by any party capable of intercepting the network connection. The documentation describes an HTTPS example but does not enforce HTTPS in code.

Attack Path

  1. A user or deployment configuration sets JENKINS_URL to an http:// Jenkins endpoint.
  2. The script combines JENKINS_USER and JENKINS_API_TOKEN and Base64-encodes them.
  3. The resulting value is sent in the Authorization: Basic header over the unencrypted connection.
  4. An attacker positioned on the same network, an intermediate proxy, or another network-monitoring componen ...[truncated 868 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse the configured endpoint with new URL(JENKINS_URL) and reject malformed URLs.
  • Require the https: protocol before creating or sending an authorization header.
  • If unencrypted HTTP is necessary for local development, require an explicit insecure-mode option and restrict it to loopback addresses such as 127.0.0.1 or localhost.
  • Do not treat the HTTPS example in documentation as an adequate control; enforce the requirement at runtime.
  • Ensure TLS certificate validation remains enabled. Do not introduce options that disable certificate verification.
  • Use a narrowly scoped Jenkins service account and token so that credential compromise has limited impact.
  • Rotate any API token that may previously have been sent to a Jenkins endpoint over HTTP.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/jenkins.mjs:56
Finding

Sensitive build parameters may be exposed through URLs and error logs

Content
View full analysis

Vulnerability Details

File Location: scripts/jenkins.mjs, lines 56-62 and line 113
Vulnerability Type: Sensitive information exposure through query strings and diagnostic logging
Risk Level: Medium

Vulnerable Code

js
if (!res.ok) {
  console.error(JSON.stringify({
    ok: false,
    status: res.status,
    statusText: res.statusText,
    url: url,
    error: text,
  }, null, 2));
js
buildUrl = `/job/${encodeURIComponent(job)}/buildWithParameters?${new URLSearchParams(params)}`;

Technical Analysis

Parameterized build values are serialized into the request URL's query string. Jenkins build parameters can include credentials, tokens, signing values, deployment keys, or other sensitive configuration supplied by an operator.

Query strings are commonly retained by HTTP access logs, reverse proxies, observability platforms, and diagnostic systems. In addition, when a Jenkins request fails, this script writes the complete request URL to standard error without redacting its query parameters. Consequently, sensitive build parameter values can be persisted in local output, CI logs, centralized log aggregation, or monitoring records.

HTTPS protects the URL while it is in transit between TLS endpoints, but it does not prevent the client, Jenkins server, reverse proxies, or logging infrastructure from recording the query string.

Attack Path

  1. An operator invokes the build command with a sensitive parameter, such as a deployment token, in the --params JSON value.
  2. The script converts every parameter into a query-string entry using URLSearchParams.
  3. The complete URL is sent to Jenkins and may be recorded by Jenkins, a reverse proxy, or infrastructure monitoring.
  4. If Jenkins returns a non-success response, the script also prints the complete URL, including the sensitive values, to standard error.
  5. An attacker or unauthorized user with access to terminal captures ...[truncated 830 chars]
Remediation
View remediation

Remediation Suggestions

  • Send parameterized build values in the POST request body where supported by the Jenkins endpoint instead of placing them in the URL.
  • Set the body content type appropriate to the Jenkins API representation, such as application/x-www-form-urlencoded, when submitting URL-encoded form data.
  • Before logging a failed request, construct a sanitized URL that removes the query string or replaces every parameter value with a fixed redaction marker.
  • Avoid printing raw Jenkins error bodies unless they are sanitized, because server responses may also contain sensitive operational information.
  • Document that secrets should be supplied through Jenkins credential bindings or another dedicated secret-management mechanism rather than ordinary build parameters.
  • Configure Jenkins, reverse proxies, and observability systems to suppress or redact query strings.
  • Rotate secrets that may already have been submitted through this interface and remove affected records from accessible logs where feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill uses sensitive capabilities implicitly: it requires environment-provided Jenkins credentials and performs network actions against a Jenkins server, but it does not declare any tool scope or permission boundary. This weakens reviewability and least-privilege controls, making it easier for an agent or operator to invoke credentialed network operations without explicit authorization metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs users how to trigger and stop Jenkins builds but omits warnings that these actions can deploy code, interrupt production pipelines, cancel test evidence, or disrupt shared CI/CD infrastructure. In a Jenkins context, these are operationally sensitive actions, so presenting them as routine commands increases the chance of unsafe or unauthorized use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code reads sensitive environment variables and immediately uses them to send authenticated HTTP requests to a Jenkins server. Aside from a missing-variable error, the file provides no user-facing warning, comment, or confirmation that credentials will be used for network operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The build path performs a POST request that starts a Jenkins job, which is a state-changing remote action and may consume infrastructure resources or deploy code. The file contains no confirmation prompt, warning text, or explanatory comment telling users that invoking this command will trigger a real build.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This command sends a POST request to stop a running Jenkins build, which can interrupt CI workflows and discard in-progress work. The file does not include any confirmation, warning, or descriptive notice that the command will terminate a remote build.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/jenkins.mjs:30