pipelinek-local-ci

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the PipelineK binary and associated asdf plugins from the author's official GitHub repositories (e.g., github.com/Rubentxu/pipeline-kotlin). This behavior is part of the core bootstrap functionality and uses established version-aware managers like mise and asdf.
  • [COMMAND_EXECUTION]: The skill executes shell commands to interact with toolchain managers (mise, asdf) and runs CI pipelines using the pipelinek run command. It also utilizes standard development wrappers such as ./gradlew, ./mvnw, and npm when detected in the project.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository (such as build manifests and legacy CI configuration files) to automate the creation or migration of pipelines.
  • Ingestion points: 01-pipeline-authoring.md and 03-migration-hosted-ci.md describe reading files like package.json, Jenkinsfile, and pyproject.toml to extract build and test logic.
  • Boundary markers: SKILL.md and 01-pipeline-authoring.md include strict instructions to avoid fictitious commands and placeholders, emphasizing the use of observed commands only.
  • Capability inventory: The skill uses pipelinek run to execute shell scripts defined in pipeline.kts, and manages system-level toolchains via mise/asdf.
  • Sanitization: SKILL.md mandates the use of pipelinek validate on any generated or edited pipeline to ensure DSL integrity before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 06:57 PM