circleci-automation
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires users to add a remote MCP server endpoint (
https://rube.app/mcp). This establishes a dependency on third-party infrastructure that is not a recognized well-known service or trusted organization. The server acts as a remote tool provider for all CircleCI operations. - [DATA_EXFILTRATION]: Because the skill utilizes an external MCP server to manage CircleCI connections (
RUBE_MANAGE_CONNECTIONS) and fetch data, sensitive information—including authentication status, project metadata, and build artifacts—is processed by therube.appinfrastructure. The claim 'No API keys needed' suggests the external server may handle or proxy authentication credentials. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests and processes untrusted data from an external CI/CD environment.
- Ingestion points: Data enters the agent context via
CIRCLECI_GET_JOB_ARTIFACTSandCIRCLECI_GET_TEST_METADATA(specifically test failure messages in JUnit XML). - Boundary markers: The instructions do not provide delimiters or 'ignore' instructions for the data retrieved from CircleCI.
- Capability inventory: The agent has the capability to trigger new pipelines (
CIRCLECI_TRIGGER_PIPELINE), list workflows, and manage connections. - Sanitization: There is no mention of sanitizing or escaping the content retrieved from artifacts or test metadata before it is presented to the agent.
Audit Metadata