fetching-circleci-logs
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the sensitive file path
~/.circleci/cli.ymlto extract a CircleCI API token for authentication. - [COMMAND_EXECUTION]: Executes an inline Python script via
python3 -cto process API responses and dynamically fetch log content. - [EXTERNAL_DOWNLOADS]: Performs network requests to
circleci.comand retrieves log files from pre-signed S3 URLs (output_url) provided by the API. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from CircleCI logs and displays them to the agent.
- Ingestion points: Data fetched from external
output_urllinks inSKILL.md. - Boundary markers: None identified; log content is processed without delimiters or warnings to ignore embedded instructions.
- Capability inventory: File system access (
grep), network operations (curl,urllib.request), and dynamic code execution (python3) are available inSKILL.md. - Sanitization: None; while log messages are truncated to 2000 characters, they are not sanitized or filtered for malicious instructions.
Audit Metadata