fix-buildkite-ci
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Buildkite logs and artifacts to guide automated code and test modifications, which could be exploited to influence agent behavior through adversarial log content. ● Ingestion points: Buildkite job logs and artifacts (e.g., risedev-logs.zip) fetched in references/buildkite-ci-triage.md. ● Boundary markers: No delimiters or ignore instructions are used to separate untrusted log content from the agent's task context. ● Capability inventory: The skill utilizes gh and bk CLI tools, curl for network operations, and performs local file writes to apply code fixes as described in SKILL.md. ● Sanitization: While log content is processed to remove ANSI escape codes using tr and perl, there is no validation of the semantic content to prevent embedded prompt instructions.
- [COMMAND_EXECUTION]: The skill automates workflows using several system tools including gh, bk, curl, jq, tr, and perl. These capabilities are intended for CI triage but grant the agent significant shell execution surface.
- [EXTERNAL_DOWNLOADS]: The skill fetches build metadata, logs, and artifacts from Buildkite (buildkite.com). These operations are consistent with the skill's purpose and target a well-known service infrastructure.
Audit Metadata