flux
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the Flux CLI by piping a script from a remote URL (https://fluxcd.io/install.sh) directly into a shell with elevated privileges (sudo bash).
- [CREDENTIALS_UNSAFE]: Example commands for configuring Git authentication involve reading sensitive private files from the local filesystem, specifically ~/.ssh/id_rsa, to populate Kubernetes secrets.
- [EXTERNAL_DOWNLOADS]: Fetches components from various external sources, including GPG keys from pkgs.fluxcd.io and third-party plugins from GitHub (github.com/tablexi/asdf-flux2.git).
- [COMMAND_EXECUTION]: Performs administrative system changes including package installation via apt-get, modification of /etc/apt/ directories, and appending persistent logic to shell profile files (~/.bashrc, ~/.zshrc) for command completion.
- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by design. It ingests data from external Git/Helm/OCI repositories and reconciles them into the cluster.
- Ingestion points: GitRepository, HelmRepository, OCIRepository, and Bucket resources defined in references/gitops-sources.md.
- Boundary markers: None found; the instructions do not include delimiters or warnings for external content.
- Capability inventory: The skill utilizes the flux and kubectl binaries to modify Kubernetes cluster state based on external data.
- Sanitization: No explicit validation or sanitization of ingested manifests is documented within the skill instructions.
Audit Metadata