pipelinek-local-ci
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the PipelineK binary and associated asdf plugins from the author's official GitHub repositories (e.g., github.com/Rubentxu/pipeline-kotlin). This behavior is part of the core bootstrap functionality and uses established version-aware managers like mise and asdf.
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with toolchain managers (mise, asdf) and runs CI pipelines using the
pipelinek runcommand. It also utilizes standard development wrappers such as./gradlew,./mvnw, andnpmwhen detected in the project. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository (such as build manifests and legacy CI configuration files) to automate the creation or migration of pipelines.
- Ingestion points:
01-pipeline-authoring.mdand03-migration-hosted-ci.mddescribe reading files likepackage.json,Jenkinsfile, andpyproject.tomlto extract build and test logic. - Boundary markers:
SKILL.mdand01-pipeline-authoring.mdinclude strict instructions to avoid fictitious commands and placeholders, emphasizing the use of observed commands only. - Capability inventory: The skill uses
pipelinek runto execute shell scripts defined inpipeline.kts, and manages system-level toolchains via mise/asdf. - Sanitization:
SKILL.mdmandates the use ofpipelinek validateon any generated or edited pipeline to ensure DSL integrity before execution.
Audit Metadata