A setup and troubleshooting command for the JFrog plugin, a tool used to work with JFrog package and artifact services. It checks required software and configuration in a fixed order, stopping at the first failed check and guiding the matching fix.

First-time installation, completing JFrog configuration, verifying login or access-token setup, selecting a project, and diagnosing a broken plugin setup.

It helps identify whether Node, the JFrog command-line tool, login, or project selection is preventing the plugin from working.

jfrog-init — Skill by jfrog

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/jfrog/claude-plugin/jfrog-init

Any agent

npx skills add jfrog/claude-plugin --skill jfrog-init

Clone the repo

git clone --depth 1 https://github.com/jfrog/claude-plugin

Made for: Claude Code, Codex.

Or install jfrog, the plugin that ships this one along with the rest of its 7 skills, 4 hooks, 1 MCP server.

Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 8,189 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 1 finding. Scan, not verified.

Origin 89% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00031	$0.08189
Opus 5	$0.00015	$0.04095
Sonnet 5	$0.00006	$0.01638
Haiku 4.5	$0.00003	$0.00819

Measured today against content hash 2dbca5ea7b04, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

jfrog-init scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

The scan reads SKILL.md. This mod also ships 24 executable files (scripts/jfrog-add-claude-marketplace.mjs, scripts/jfrog-detect-all.mjs, scripts/jfrog-detect-catalog-runtime.mjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

`~/.netrc` write (also unattended, no `AskUserQuestion` — see

Origin

This is a copy

89% identical to jfrog-init — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

skills/jfrog-init/SKILL.md · 603 lines

How it starts

The opening of the file, as written. The whole thing — 603 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/jfrog-init — verify and guide JFrog plugin readiness

First output must be a tool call, not text. No "I'll start..." preamble.

Walks a fixed, ordered checklist and stops at the first red result, guiding the user through the matching fix before re-checking. Every detector in scripts/ is idempotent, read-only, JSON-emitting, and implemented in Node (.mjs), so the same detector runs unmodified on macOS, Linux, and Windows. Step 3's web-login uses this skill's own local .mjs scripts, same as every other step. The one interactive fix step that isn't a Node script at all is Step 1's Node install itself — a missing Node can't run a .mjs installer, so that one step branches on OS or shell directly.

Approval model — every user-approval point is detailed in its own Step below (exact wording, AskUserQuestion payloads, forbidden phrases); this is just the map:

node — AskUserQuestion Yes/No before auto-installing (Step 1).
jf (JFrog CLI) — AskUserQuestion Yes/No before auto-installing (Step 2).
jf config — AskUserQuestion picker (web login, in-session, vs. access token, which never enters this conversation) (Step 3/4).
Project selection — the user answers with a project name or key; an AskUserQuestion picker offers the first two enumerated projects plus "Other" (Step 6).
Everything else in the walk is read-only, except Step 5's placeholder substitution (writes the plugin's mcp.json, unattended by design — no AskUserQuestion, see references/script-invocation.md), Step 8's ~/.netrc write (also unattended, no AskUserQuestion — see references/marketplace-setup.md), and the Final summary's state write below.

Step 1's nvm install and jfrog-install-jf-cli.mjs, Step 3's web-login scripts, Step 8's jfrog-add-claude-marketplace.mjs call, and the Final summary's jfrog-state-file.mjs set call are deliberately not in allowed-tools and will raise the harness's own approval prompt — intended, not a misconfiguration; see references/script-invocation.md.

${CLAUDE_SKILL_DIR} below is this file's own directory. Claude Code substitutes it automatically, identically, in both this text and the allowed-tools Bash rules above — write it literally rather than resolving it yourself, so the two stay byte-for-byte consistent regardless of install depth (see references/script-invocation.md). On a harness that doesn't perform this substitution (e.g. Cursor or Codex, neither of which consults allowed-tools for approval — every command below still raises its own prompt there), replace it with the real absolute path of this file's directory yourself, same as before.

Read the full file on GitHub · 603 lines

Files

What ships with it

41 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · -1 lines 2dbca5ea7b04
3d ago First seen · 604 lines · 31 tokens per session scan C 56a471cccc7f

Subscribe to this mod's changes

jfrog-init is a skill published in the GitHub repository jfrog/claude-plugin (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 31 tokens to every session and 8,189 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). It is 89% identical to jfrog-init, differing in 0 lines, and is treated as a copy.

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens

chat-perf

Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.

microsoft/vscode · 51 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

jfrog-init