manage-ci-artifacts
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script constructs file system paths using the
run_idparameter without sanitizing for path traversal characters (e.g.,../). - Evidence: In
scripts/manage-ci-artifacts.py, the_run_dirfunction concatenatesrun_iddirectly:get_plan_dir(plan_id) / _ARTIFACTS_SUBDIR / run_id. A maliciousrun_idvalue could allow the creation of directories or writing of files outside the intendedartifacts/ci-runsscope. - [PROMPT_INJECTION]: The skill ingests untrusted data from CI logs and external JSON files, creating an indirect prompt injection surface.
- Ingestion points: Data is loaded from a user-specified
--jobs-fileand fetched from external CI logs via provider-specific integration. - Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded content when storing artifact data.
- Capability inventory: The skill possesses the capability to perform file system write operations within the plan directory.
- Sanitization: While job filenames are sanitized, the raw content of CI logs and the data within the job manifests are not filtered or validated for malicious instructions.
Audit Metadata