Jenkins 任务全生命周期管理工具，支持任务列表获取、远程构建、构建状态实时查询、构建日志全文获取、运行中构建强制终止，适用于 CI/CD 自动化、发布流水线、运维自动化场景。

What to consider before installing: - Do not assume credentials are read from environment variables: this skill's code reads credentials from a local config.json (base_url, username, api_token), while the SKILL.md tells you to set JENKINS_URL/JENKINS_USER/JENKINS_TOKEN. Ask the publisher which config method is authoritative and confirm where credentials will be stored. - Avoid placing real Jenkins credentials into the skill package. If the skill requires config.json, do not commit credentials into the package; instead store the file securely on the host with strict permissions or modify the code to read env vars. - Use a least-privilege Jenkins account (service account / token) when granting access. Prefer tokens with limited scopes and separate accounts per integration. - The requirements pull jenkinsapi from PyPI (expected). Verify that your deployment environment installs dependencies from trusted registries and that you are comfortable installing those packages. - Because the publisher/source is unknown, review or run the code in an isolated environment first. If you want the documented env-var behavior, consider modifying the skill to read environment variables (or request the maintainer to fix SKILL.md to match the implementation). If you cannot confirm or fix the config mismatch, treat this skill as risky for production use due to potential accidental credential exposure or misconfiguration.

Type: OpenClaw Skill Name: jenkins-executor-job Version: 1.0.0 The skill provides a functional interface for Jenkins CI/CD management using the 'jenkinsapi' library. It is classified as suspicious due to a security vulnerability in its credential handling: the '__init__.py' script requires sensitive credentials (username and API token) to be stored in a local 'config.json' file, which is a poor security practice compared to the environment variables suggested in 'SKILL.md'. While the code logic aligns with the stated purpose of managing Jenkins jobs, the combination of high-privilege access (triggering builds, reading logs) and insecure secret storage poses a significant risk of credential exposure.