manage-ci-artifacts

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script constructs file system paths using the run_id parameter without sanitizing for path traversal characters (e.g., ../).
  • Evidence: In scripts/manage-ci-artifacts.py, the _run_dir function concatenates run_id directly: get_plan_dir(plan_id) / _ARTIFACTS_SUBDIR / run_id. A malicious run_id value could allow the creation of directories or writing of files outside the intended artifacts/ci-runs scope.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from CI logs and external JSON files, creating an indirect prompt injection surface.
  • Ingestion points: Data is loaded from a user-specified --jobs-file and fetched from external CI logs via provider-specific integration.
  • Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded content when storing artifact data.
  • Capability inventory: The skill possesses the capability to perform file system write operations within the plan directory.
  • Sanitization: While job filenames are sanitized, the raw content of CI logs and the data within the job manifests are not filtered or validated for malicious instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:12 AM
Security Audit — agent-trust-hub — manage-ci-artifacts