circleci-smarter-testing-run
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the circleci CLI. This includes running test suites, listing tests, and installing CLI extensions. These operations are standard for a CircleCI integration and are associated with a trusted vendor resource.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that relies on ingesting and acting upon untrusted data from local configuration files.
- Ingestion points: Data is read from .circleci/test-suites.yml to determine suite names and discovery commands used in shell execution.
- Boundary markers: The instructions include a requirement to single-quote regex patterns passed to the CLI to prevent shell-level injection or misinterpretation.
- Capability inventory: The agent uses the circleci CLI which has the capability to run discovery commands defined in the config file and perform network operations.
- Sanitization: The skill recommends using the list-tests command to validate the impact of regex patterns and provides guidance on correct regex syntax to ensure reliable execution.
Audit Metadata