ci-cd-pipeline-builder
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because its core functionality involves reading and processing repository configuration files (such as
package.json) to generate CI configuration.\n - Ingestion points:
scripts/stack_detector.pyandscripts/pipeline_generator.pyread project manifests likepackage.json,pyproject.toml, andgo.modto determine build steps.\n - Boundary markers: The skill does not employ specific delimiters or security instructions to isolate or ignore potentially malicious content embedded within the ingested repository manifests.\n
- Capability inventory: The skill uses Python scripts to perform local file read and write operations, and generates shell commands that are intended for use in CI/CD environments.\n
- Sanitization: Commands extracted from project manifests (e.g., from the
scriptssection ofpackage.json) are directly interpolated into the output YAML templates without sanitization or validation, though this is expected behavior for the tool's intended purpose.
Audit Metadata