The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external data by instructing the agent on how to retrieve job outputs and test results using the circleci job output get and circleci testresult list commands. This creates a vulnerability surface where malicious instructions embedded in build logs could attempt to override the agent's behavior during log analysis or troubleshooting tasks.
Ingestion points: Build logs and job outputs accessed via circleci job output list and circleci job output get as documented in SKILL.md.
Boundary markers: The instructions lack guidance for the agent to treat these external outputs as untrusted data or to use specific delimiters to isolate the content from its system instructions.
Capability inventory: The agent has access to the full circleci CLI, which includes the ability to manage environment variables, trigger pipelines, and list secrets, providing a path for potential exploitation if an injection succeeds.
Sanitization: There are no instructions for sanitizing or filtering the output before the agent processes the retrieved text.

circleci