The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically Buildkite build logs and pipeline metadata, which could contain malicious instructions intended to manipulate agent behavior.
Ingestion points: Data enters the agent context through the outputs of bk build view (JSON metadata) and bk job log (text-based logs).
Boundary markers: Absent; the instructions do not define specific delimiters or guardrails to wrap this external content when it is interpolated into the agent's prompt.
Capability inventory: The agent has access to a restricted Bash tool (limited to the bk CLI suite) and the AskUserQuestion tool.
Sanitization: The skill includes instructions to strip ANSI escape sequences and internal platform metadata (e.g., _bk;t=... markers) from logs before analysis, but does not provide prompt-level escaping for the content itself.
[COMMAND_EXECUTION]: The skill relies on the bk CLI for all CI operations. The allowed-tools configuration grants access to bk config get, a subcommand capable of retrieving local configuration values, which may include sensitive authentication tokens or environment settings. While the skill's instructions explicitly forbid the agent from extracting or misusing these secrets, the technical capability to access them exists within the defined tool scope.

wk-buildkite