The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external sources including Jenkins build logs and SCM change sets (commit messages and author metadata) which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: getBuildLog, searchBuildLog, getPipelineRunLog, and getBuildChangeSets (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or "ignore" directives to isolate retrieved log or commit content from the agent's core instructions.
Capability inventory: The skill has the ability to trigger and update builds through the triggerBuild and updateBuild tools (SKILL.md).
Sanitization: No sanitization or filtering requirements are mentioned for the external content retrieved from logs or SCM data.
[COMMAND_EXECUTION]: The skill exposes tools to trigger and modify CI/CD builds (triggerBuild, updateBuild), which are powerful remote execution capabilities. The risk is managed by instructional rules requiring human-in-the-loop confirmation and read-before-write validation.
[DATA_EXFILTRATION]: The skill performs network operations to remote Jenkins instances via HTTP and retrieves sensitive metadata such as SCM repository URLs and credential identifiers (getJobScm), which could expose internal infrastructure details to the agent's context.

jenkins-cicd