server-security-init-skill
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill interacts with sensitive local SSH private key files (~/.ssh/id_ed25519) to test connections and update host configurations. While necessary for the stated purpose, this involves handling high-sensitivity credentials.
- [CREDENTIALS_UNSAFE]: Stage 3 of the hardening process configures a new administrative user with NOPASSWD:ALL in the sudoers directory (/etc/sudoers.d/admin). This practice allows any process running as that user to gain full root privileges without password verification, potentially weakening the target system's security posture.
- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to fetch and execute the skill using npx from a GitHub repository (github.com/DeerYang/server-security-init-skill) that is not verified and does not clearly align with the stated author vendor (Aradotso).
- [COMMAND_EXECUTION]: The skill instructs the agent to perform extensive system-level modifications on remote servers, including using sed to rewrite /etc/ssh/sshd_config and manipulating systemd units (ssh.socket, ssh.service).
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by interpolating variables such as server_ip, current_user, and target_user into shell commands without sanitization or boundary markers.
- Ingestion points: Variables defined in the bootstrap_info object in SKILL.md.
- Boundary markers: No delimiters or safety warnings are present to prevent command injection if these variables contain malicious shell characters.
- Capability inventory: The skill uses ssh, sudo, sed, and systemctl, which are high-privilege capabilities.
- Sanitization: There is no evidence of input validation or shell escaping for the interpolated values.
Audit Metadata