buildkite@r7
CAUTION· install onlyPublisher claims: "Buildkite MCP lets agents interact with Buildkite Builds, Jobs, Logs, Packages and Test Suites" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher buildkite · publishing for 130 daysInstalls 13,786Last detonated 40 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ANTHROPIC_API_KEYBUILDKITE_AGENT_ACCESS_TOKENBUILDKITE_API_TOKENCURSOR_API_KEYDD_API_KEYDOCKERHUB_PASSWORDENTRY_TOKENEVAL_COMPARE_BUILDKITE_API_TOKENGITHUB_TOKENJEV_TOKENMCP_EVAL_FRAMEWORK_JEV_TOKENor--with-token/--api-token/--api-token-from-1passwordConfiguration, not credentials: AGENT_PATH, ANNOTATE_MESSAGES, ANNOTATION_CONTEXT_PREFIX, ANTHROPIC_BASE_URL, BK_SHIM_REAL_BK, BK_SHIM_REQUEST_LOG, BUILDKITE_AGENT_ENDPOINT, BUILDKITE_GRAPHQL_ENDPOINT, BUILDKITE_REQUEST_LOG, BUILDKITE_REST_API_ENDPOINT, PROJECT_PATH, REFERENCE_PATH, RUN_KEY, TEST_API, TEST_EXIT, TEST_PATH- Where it talks to
- no vendor host named in the codeAlso buildkite.com, cursor.com, githubusercontent.com, api.example, storage.example, api.invalid, invalid.test, typesafe.ai — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names buildkite.com, cursor.com, githubusercontent.com, api.example, storage.example, api.invalid, invalid.test, typesafe.ai as well as its own vendor. The guard injects ANTHROPIC_API_KEY, BUILDKITE_AGENT_ACCESS_TOKEN, BUILDKITE_API_TOKEN, CURSOR_API_KEY, DD_API_KEY, DOCKERHUB_PASSWORD, ENTRY_TOKEN, EVAL_COMPARE_BUILDKITE_API_TOKEN, GITHUB_TOKEN, JEV_TOKEN, MCP_EVAL_FRAMEWORK_JEV_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- docker run -i --rm mcp/buildkite
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is buildkite@r7 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Hidden zero-width characters detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
Remote installer piped to shellevals/Dockerfile:36 · Remote installer piped to shell
AST07RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Destructive file system command detectedpkg/buildkite/joblogs.go:67 · Destructive file system command detected
AST05// reduced to TerseLogEntry, so search_logs matches the {ts,c,rn} formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Pipe-to-shell patternevals/Dockerfile:101 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06RUN curl -fsS https://cursor.com/install | bashFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Hidden zero-width characters detectedevals/scripts/yilong.sh:380 · Hidden zero-width characters detected — may conceal content
AST07echo "--- 🧑🏻⚖️ [$ENTRY] yilong"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/Dockerfile:48 · File permission modification command — agent changes file ownership/permissions
AST05-o /usr/local/bin/shfmt && chmod +x /usr/local/bin/shfmtFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Hidden zero-width characters detectedevals/scripts/yilong.sh:347 · Hidden zero-width characters detected — may conceal content
AST07"<details open><summary>🧑🏻⚖️ [\(.entry)] yilong — verdicts</summary>\n",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/Dockerfile:44 · File permission modification command — agent changes file ownership/permissions
AST05-o /usr/local/bin/yq && chmod +x /usr/local/bin/yqFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Remote installer piped to shellevals/Dockerfile:101 · Remote installer piped to shell
AST07RUN curl -fsS https://cursor.com/install | bashFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Pipe-to-shell patternevals/Dockerfile:36 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.CRITICAL
Fake instruction boundary tagevals/prompts/klaren.md:52 · Fake instruction boundary tag
AST01…ith it. Produce self-contained Markdown candidates suitable for `evals/expected/<prompt>/<scenario.id>/root_cause.md` and `fix.md`. The harness supplies `reference_path…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Destructive file system command detectedevals/Dockerfile:38 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Destructive file system command detectedevals/Dockerfile:33 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/scripts/babystand.sh:262 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$dir/bin/bk"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/Dockerfile:91 · File permission modification command — agent changes file ownership/permissions
AST05RUN chown -R agent:agent /workspaceFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.CRITICAL
Pipe-to-shell patternevals/scripts/cursor.sh:48 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06echo "Error: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/install | bash)"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Remote installer piped to shellevals/scripts/babystand.sh:446 · Remote installer piped to shell
AST07echo "ERROR: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/install | bash)" >&2Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.CRITICAL
Pipe-to-shell patternevals/scripts/babystand.sh:446 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06echo "ERROR: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/install | bash)" >&2Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:120 · Python subprocess execution detected
AST05metrics = subprocess.run([str(self.root / "scripts/dd-metrics.sh")], check=True,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_tool_audit.py:72 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialsevals/scripts/test_bk_request_log.py:199 · URL with embedded credentials — may be phishing or credential leaking
AST07HTTP_PROXY='http://fixture-proxy-user:[email protected]:1')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionevals/scripts/parser.ts:686 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(" -o <file> Save output to file (only when streaming from stdin)");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Remote installer piped to shellevals/scripts/cursor.sh:48 · Remote installer piped to shell
AST07echo "Error: cursor-agent not found on PATH (install: curl -fsS https://cursor.com/install | bash)"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:103 · Python subprocess execution detected
AST05return subprocess.run([self.node, str(SCRIPTS / 'bk-request-log-shim.mjs'), *args],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:423 · Python subprocess execution detected
AST05result = subprocess.run([str(self.root / "scripts/dd-publish.sh")],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Fake instruction boundary tagevals/evals.yaml:36 · Fake instruction boundary tag · informational: not an instruction file
AST01# prompt Name of a template under prompts/<prompt>.md. Rendered with theFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:308 · Python subprocess execution detected
AST05result = subprocess.run([str(self.scripts / "babystand.sh")], cwd=self.root, capture_output=True, text=True,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:66 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:134 · Python subprocess execution detected
AST05rendered = subprocess.check_output(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:82 · Python subprocess execution detected
AST05markdown = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:66 · Python subprocess execution detected
AST05result = subprocess.run([str(self.scripts / "klaren.sh"), str(self.transcript),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Fake instruction boundary tagevals/README.md:194 · Fake instruction boundary tag · informational: not an instruction file
AST01then copy the reviewed content into `evals/expected/<prompt>/<scenario.id>/root_cause.md` orFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:80 · Python subprocess execution detected
AST05result = subprocess.run([str(self.scripts / "dd-publish.sh")], check=True, capture_output=True, text=True,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actionevals/scripts/test_yilong.py:39 · File type combined with upload action — agent may exfiltrate local data files
AST07(self.root / "run.tools.txt").write_text('{"tool":"get_logs","input":{"job":"failing"}}\n')Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/scripts/babystand.sh:328 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$dir/bk"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actionevals/scripts/parser.ts:683 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(" cat <input-file> | chat-parser - -o <output-file>");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:90 · Python subprocess execution detected
AST05payload = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Fake instruction boundary tagevals/evals.yaml:41 · Fake instruction boundary tag · informational: not an instruction file
AST01# expected/<prompt>/<scenario.id>/{root_cause,fix}.md. Use a newFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/scripts/babystand.sh:316 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$dir/bk"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.LOW
Fake instruction boundary tagevals/evals.yaml:64 · Fake instruction boundary tag · informational: not an instruction file
AST01# expected/<prompt>/<scenario.id>/{root_cause,fix}.mdFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/scripts/cursor.sh:41 · File permission modification command — agent changes file ownership/permissions
AST05chown -R agent:agent "$(pwd)"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actionevals/scripts/parser.ts:682 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(" cat <input-file> | chat-parser -");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:359 · Python subprocess execution detected
AST05metrics = subprocess.run([str(self.root / "scripts/dd-metrics.sh")], check=True,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:416 · Python subprocess execution detected
AST05subprocess.run([str(self.root / "scripts/yilong.sh")], env=env, capture_output=True, text=True, check=True)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:35 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_cli_token.py:48 · Python subprocess execution detected
AST05return subprocess.run(["bash", str(root / "scripts/babystand.sh")],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:216 · Python subprocess execution detected
AST05return subprocess.check_output(["git", "-c", "user.name=Fixture", "-c", "[email protected]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File permission modification commandevals/scripts/claude.sh:28 · File permission modification command — agent changes file ownership/permissions
AST05chown -R agent:agent "$(pwd)"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actionevals/scripts/parser.ts:681 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log("Usage: chat-parser <input-file>");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:142 · Python subprocess execution detected
AST05subprocess.run(['openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '1',Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:107 · Python subprocess execution detected
AST05result = subprocess.run([str(self.root / "scripts/yilong.sh"), str(self.judge)],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_tool_audit.py:96 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:129 · Python subprocess execution detected
AST05summary = subprocess.check_output(Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Privileged sudo commandevals/scripts/test_tool_audit.py:53 · Privileged sudo command — agent may execute with elevated privileges
AST05('sudo -u agent -- bk build view 123', ['bk build view']),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.Cost to the agent
Instructions loaded
≈1,413 tok
3 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim buildkite: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Hidden zero-width characters detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- Remote installer piped to shell≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- Pipe-to-shell pattern≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- File permission modification command≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim buildkitePropose a patch to the maintainer