buildkite-preflight
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from build logs and test summaries which may contain untrusted content.
- Ingestion points: Build logs retrieved via
bk job log, structured event data frombk preflight --json, and test engine failure reports. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded content within logs.
- Capability inventory: The skill utilizes shell command execution through
bk,git, andjqtools. - Sanitization: No explicit sanitization or filtering is prescribed for the content of build logs or job outputs before the agent interprets them.
- [COMMAND_EXECUTION]: The skill's primary functionality is implemented through the execution of shell commands.
- Evidence: The skill provides numerous examples for using
bk preflight,bk build view,bk job list, andbk job logto interact with CI infrastructure.
Audit Metadata