ci-autofix
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CI Failure Logs and Terminal Output (Step 1). An attacker could intentionally fail a CI job with a payload designed to hijack the agent's logic during the auto-remediation loop.
- Ingestion points: CI Failure Log / Terminal Output (SKILL.md).
- Boundary markers: Absent. No specific delimiters or 'ignore' instructions are defined for the log ingestion phase.
- Capability inventory: Shell command execution (Step 3: 'npm run lint') and file system writes (Step 3: 'Apply the code change').
- Sanitization: Absent. While the 'Security' section claims the agent must redact secrets, no implementation details or strict filtering mechanisms are provided in the instructions.
- [DATA_EXFILTRATION]: The skill processes raw CI logs which frequently contain leaked environment variables or connection strings after a build crash. This data is fed to an external LLM for analysis, potentially exfiltrating secrets to the LLM provider.
- [COMMAND_EXECUTION]: The skill is designed to run arbitrary local commands to verify fixes (e.g., 'npm run lint', 'unit tests'). This capability, while necessary for the skill's purpose, presents a risk if the remediation logic is compromised via prompt injection.
Audit Metadata