loongsuite-pilot-ops
Fail
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions and commands to download and execute shell scripts for installation and environment patching.
- Fetches and executes an installation script from
aliyun-observability-release-cn-shanghai.oss-cn-shanghai.aliyuncs.com, which is an Alibaba Cloud service endpoint matching the skill's author. - Downloads and runs a glibc compatibility patch from the same Alibaba Cloud OSS domain for Linux 7U environments.
- Downloads and executes the
nvm(Node Version Manager) installer from the officialnvm-sh/nvmGitHub repository, which is a well-known service for managing Node.js runtimes. - [PERSISTENCE]: The tool manages background services to ensure telemetry collection continues across system restarts.
- Uses
deploy/autostart.shto install and managelaunchdplists on macOS andsystemduser units on Linux for both the main collector daemon and an auto-updater service. - [COMMAND_EXECUTION]: The skill requires extensive use of the shell to perform its operational tasks.
- Executes various administrative commands for service status checks, configuration modification, and diagnostic reporting.
- Employs a Python-based utility script to perform structural modifications to the local
config.jsonfile. - [EXTERNAL_DOWNLOADS]: Fetches required binaries and configuration files from external sources.
- References packages from
npmjs.comand GitHub for various AI agent CLI tools (e.g.,@anthropic-ai/claude-code,@openai/codex) during testing and installation workflows. - [CREDENTIALS_UNSAFE]: The skill involves the configuration of cloud access credentials (AK/SK) but includes strong defensive instructions.
- Contains templates for configuring Alibaba Cloud Log Service (SLS) credentials but explicitly warns users in
SKILL.mdNOT to share these secrets with the AI agent, advising manual execution in the user's terminal instead.
Recommendations
- HIGH: Downloads and executes remote code from: https://loongcollector-community-edition.oss-cn-shanghai.aliyuncs.com/loongsuite-pilot/installer.sh - DO NOT USE without thorough review
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata