Buildkite Plugin Security | Agent Skills Atlas

About this skill

Security review and vulnerability scanning for Buildkite plugins (Bash, Docker, Go). Use when auditing or hardening a plugin, reviewing plugin code for vulnerabilities before release, or answering "is this plugin secure?". Checks command/argument injection, secret leakage, unsafe eval, missing quoting, supply-chain (unpinned images/deps, unverified downloads, curl|bash), privilege (privileged containers, Docker socket, root), untrusted plugin config input, and TLS/integrity. Runs an executable scanner plus shellcheck, hadolint, gitleaks, gosec, govulncheck, and trivy when available.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

4 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

high: remote execution — SKILL.md, line 8
high: remote execution — SKILL.md, line 32
high: remote execution — SKILL.md, line 56
high: remote execution — SKILL.md, line 76

Content SHA-256: 913f43147b4a1e44394def5cf1a00451ec4722184ac65965f660d8954aef178e

About scan coverage and limitations

Original listing metadata

Original name

buildkite-plugin-security

Original description

Security review and vulnerability scanning for Buildkite plugins (Bash, Docker, Go). Use when auditing or hardening a plugin, reviewing plugin code for vulnerabilities before release, or answering "is this plugin secure?". Checks command/argument injection, secret leakage, unsafe `eval`, missing quoting, supply-chain (unpinned images/deps, unverified downloads, curl|bash), privilege (privileged containers, Docker socket, root), untrusted plugin config input, and TLS/integrity. Runs an executable scanner plus shellcheck, hadolint, gitleaks, gosec, govulncheck, and trivy when available.

About this listing

Category: Security
Reported license: MIT
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.