purple-team
Fail
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute scripts directly from the internet by piping the output of network requests into a shell (curl | sh). These scripts are hosted on individual GitHub repositories that are not identified as trusted organizations.
- Evidence: In references/skills-catalog.md, the linux-privesc section provides commands to execute linpeas.sh and lse.sh via curl -L [URL] | sh and curl -L [URL] | sh -s -- -l 1 respectively. \n- [EXTERNAL_DOWNLOADS]: The skill depends on numerous external tools and scripts downloaded from various third-party GitHub accounts during runtime.
- Evidence: Instructions in references/skills-catalog.md include downloading linux-exploit-suggester.sh using wget followed by manual execution. \n- [COMMAND_EXECUTION]: The skill provides an extensive library of powerful system and network commands, including scanners (nmap, masscan), exploit frameworks (metasploit), and privilege escalation tools. This allows for arbitrary command execution across the host and network.
- Evidence: The pentest-commands and sub-skill sections in references/skills-catalog.md list dozens of interactive and automated shell commands. \n- [DATA_EXFILTRATION]: The skill identifies and attempts to access sensitive system files and credentials as part of its auditing workflows. Combined with its network capabilities, this creates a high risk of data exposure or exfiltration.
- Evidence: In references/skills-catalog.md, instructions include reading /etc/passwd, /etc/shadow, .bash_history, private keys (.pem, .key, id_rsa), and cloud metadata (169.254.169.254). \n- [PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection because it ingests and processes untrusted data from external sources without implementing boundary markers or sanitization.
- Ingestion points: references/skills-catalog.md (Processing outputs from Shodan, Nmap, Burp Suite, web scraping, and firmware binaries).
- Boundary markers: Absent.
- Capability inventory: High (Arbitrary command execution, network access, and file system operations are distributed throughout references/skills-catalog.md).
- Sanitization: Absent (There is no evidence of filtering or escaping logic for interpolated data).
Recommendations
- AI detected serious security threats
Audit Metadata