Skills
Navigate
skills/bagelhole/devops-security-agent-skills/startup-it-troubleshooting/Gen Agent Trust Hub

startup-it-troubleshooting

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill contains patterns that download and execute scripts directly from remote sources.
  • SKILL.md: Executes a script from gam-shortn.appspot.com using bash process substitution: bash <(curl -s -S -L https://gam-shortn.appspot.com/gam-install).
  • SKILL.md: Executes the Homebrew installation script using command substitution: bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)".
  • [CREDENTIALS_UNSAFE]: The skill includes hardcoded temporary passwords in example commands which could lead to security risks if deployed in production.
  • SKILL.md: Hardcoded password TempPass123! in a Google Workspace user update command.
  • SKILL.md: Hardcoded password Welcome2Company! in a user creation command.
  • [PRIVILEGE_ESCALATION]: Several commands attempt to elevate privileges or enable remote administrative access.
  • SKILL.md: Enables remote SSH login using sudo systemsetup -setremotelogin on.
  • SKILL.md: Enables Remote Desktop (RDP) on Windows by modifying the registry (fDenyTSConnections).
  • SKILL.md: Multiple uses of sudo to modify network configurations, flush DNS caches, and manage system services.
  • [COMMAND_EXECUTION]: The skill makes extensive use of powerful shell and PowerShell commands to manage users, account security, and system states.
  • SKILL.md: Commands for modifying user MFA, backup codes, and account suspension status in identity providers.
  • SKILL.md: Commands for terminating processes (pkill, Stop-Process) and managing storage via Docker.
  • [EXTERNAL_DOWNLOADS]: The skill installs external software and modules without version pinning or integrity checks.
  • SKILL.md: pip install speedtest-cli.
  • SKILL.md: Install-Module for Microsoft 365 and Windows Update management.
  • [INDIRECT_PROMPT_INJECTION]: The "First-Day Setup Script" creates an ingestion point for user-supplied data used in shell commands.
  • Ingestion point: User input via read commands for name and email in SKILL.md.
  • Boundary markers: None.
  • Capability inventory: git, gh, sudo, bash.
  • Sanitization: None.
Recommendations
  • HIGH: Downloads and executes remote code from: https://gam-shortn.appspot.com/gam-install, https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 15, 2026, 07:05 AM