sh-agent is a program to hold private keys used for public key

authentication. Through use of environment variables the agent can

be located and automatically used for authentication when logging in

to other machines using ssh(1). ... Connections to ssh-agent may be

forwarded from further remote hosts using the -A option to ssh(1)

(but see the caveats documented therein), avoiding the need for

authentication data to be stored on other machines."

(https://man.openbsd.org/ssh-agent.1)

"Agent forwarding should be enabled with caution. Users with the

ability to bypass file permissions on the remote host ... can access

the local agent through the forwarded connection. ... A safer

alternative may be to use a jump host (see -J)."

(https://man.openbsd.org/ssh.1)