buildkite-agent-runtime
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for processing external, untrusted data (such as test output logs or JSON results) and using that data to generate build annotations or dynamic pipeline steps.
- Ingestion points: Content is read from
test-output.txt,results.json, and piped from standard input in multiple examples. - Boundary markers: Not explicitly present in the provided bash scripts; data is processed via standard CLI tools like
grepandjq. - Capability inventory: The skill leverages
pipeline uploadto dynamically create new execution steps andannotateto display processed data. - Sanitization: Scripts use structure-aware tools (
jq) to parse data, which is appropriate for the intended CI/CD orchestration use-case. - [COMMAND_EXECUTION]: The skill provides instructions for using the
buildkite-agentCLI, which is the standard tool for executing operations within Buildkite CI/CD environments. - [EXTERNAL_DOWNLOADS]: Reference recipes include standard examples of fetching assets or configuration from external sources (e.g.,
releases.example.comandvault.internal) usingcurlandwget. - [DYNAMIC_EXECUTION]: The
pipeline uploadsubcommand is documented, which is a core feature of Buildkite used to generate and execute pipeline definitions at runtime based on job logic.
Audit Metadata