The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes build logs and test results from CircleCI, which are untrusted external data sources. If an attacker can control the output of a CI job, they could attempt to inject instructions into the agent's context when it reads these logs.
Ingestion points: CircleCI API responses and log files fetched from S3 URLs in scripts/circleci.py.
Boundary markers: Absent; the skill reads and displays raw log content.
Capability inventory: Network access to CircleCI and local file write capabilities.
Sanitization: Absent; the skill is designed to retrieve raw output for debugging.
[DATA_EXFILTRATION]: The script accesses the CIRCLECI_TOKEN environment variable to authenticate with CircleCI.
Evidence: The implementation includes a custom _NoRedirect handler to ensure the authentication token is not leaked to third-party domains during HTTP redirects. It also includes logic to redact the token from error messages before they are displayed or logged.
[EXTERNAL_DOWNLOADS]: The skill downloads metadata and log files from well-known services.
Evidence: The script fetches data from circleci.com and associated S3 storage for job logs. It uses standard library functions and implements security measures such as O_NOFOLLOW and strict file permissions (0600) to protect the downloaded data.

circleci-investigate