sh "docker login -p ${PASSWORD}" puts your credential into the command line, and sh "echo ${env.CHANGE_TITLE}" lets a pull request run its own commands on your agents. This skill finds those and nine other Jenkins pipeline mistakes before they run, and tells you how to fix each one.

Your agent runs a scanner on your Jenkinsfiles (declarative and scripted, Jenkinsfile.*, *.jenkinsfile) and shared-library Groovy files. It skips Groovy comments, knows which strings Groovy fills in (double quotes) and which the shell reads at run time (single quotes, \$), which names hold credentials (withCredentials, credentials() with its USR and PSW forms, password parameters), and which parameters are free text or fixed choices. It never connects to Jenkins or runs a build. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• J01: a credential put into sh, bat or powershell with a double-quoted Groovy string

• J02: a password, token or key written in the pipeline

• J03: pull-request titles, branches or authors interpolated into shell commands

REVIEW (check before release)

• J11: evaluate(), GroovyShell or "...".execute() running on the controller

• J12: builds on the built-in node (master or built-in label)

• J13: curl -k, wget --no-check-certificate and other TLS checks turned off

• J14: downloads piped into a shell

• J15: shared libraries loaded without a version or from a branch

• J16: --privileged containers or the Docker socket mounted

• J17: input steps without a submitter

• J18: free-text build parameters interpolated into shell commands

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example pipeline, and the real report the scanner produces on the risky one

Limits

It reads each file as written: jobs set up in the Jenkins UI, parameters defined only in job settings, Job DSL, Configuration as Code and plugin versions are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 9 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (3 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.