buildkite-agent-runtime

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for processing external, untrusted data (such as test output logs or JSON results) and using that data to generate build annotations or dynamic pipeline steps.
  • Ingestion points: Content is read from test-output.txt, results.json, and piped from standard input in multiple examples.
  • Boundary markers: Not explicitly present in the provided bash scripts; data is processed via standard CLI tools like grep and jq.
  • Capability inventory: The skill leverages pipeline upload to dynamically create new execution steps and annotate to display processed data.
  • Sanitization: Scripts use structure-aware tools (jq) to parse data, which is appropriate for the intended CI/CD orchestration use-case.
  • [COMMAND_EXECUTION]: The skill provides instructions for using the buildkite-agent CLI, which is the standard tool for executing operations within Buildkite CI/CD environments.
  • [EXTERNAL_DOWNLOADS]: Reference recipes include standard examples of fetching assets or configuration from external sources (e.g., releases.example.com and vault.internal) using curl and wget.
  • [DYNAMIC_EXECUTION]: The pipeline upload subcommand is documented, which is a core feature of Buildkite used to generate and execute pipeline definitions at runtime based on job logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 01:56 AM