The convenience and risk of SSH agent forwarding

ssh -A forwards the local agent to the remote host, so you can hop onward without copying private keys.

The risk: root on that host can use the socket to authenticate to anything trusting the key, silently. A compromised jump host becomes a pass to every machine you can reach.

ProxyJump is the safer pattern — the connection originates locally and the key never leaves:

Host internal
    HostName 10.0.1.5
    ProxyJump jump

If you must forward, bound it: ssh-add -t 300 for a lifetime, ssh-add -D afterwards, and ForwardAgent yes only for specific hosts, never globally.

ssh-add -l shows what is currently loaded.