flaky-test-investigator
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from external sources, including GitHub issue comments and CI failure artifacts like logs and DOM snapshots. This creates a surface for indirect prompt injection where an attacker could influence the agent's behavior or findings by embedding instructions in these data sources.\n
- Ingestion points: GitHub issue comments, Buildkite artifact listings, and test server logs (SKILL.md).\n
- Capability inventory: The agent has the ability to execute shell commands using the
bkandghCLI tools (SKILL.md, references/pipelines.md).\n - Boundary markers: Absent. The skill does not define clear boundaries or instructions to treat the ingested data as untrusted.\n
- Sanitization: There is no evidence of sanitization for the inputs (e.g., build IDs, artifact IDs, or SHAs) before they are interpolated into CLI commands.\n- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands using
bk(Buildkite CLI) andgh(GitHub CLI) to retrieve failure artifacts and compare commit hashes. While these operations are core to the skill's purpose for investigating Kibana's CI failures, they rely on data parsed from external, potentially untrusted contexts.
Audit Metadata