arch-linux-cachyos
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md file contains a 'Hard constraints' section that provides specific instructions to the AI agent intended to restrict its behavior, such as forbidding the direct invocation of sudo and requiring high levels of certainty for bootloader changes. These represent instructions that override the agent's standard decision-making processes.\n- [COMMAND_EXECUTION]: The skill uses high-privilege administrative commands (via sudo) to modify system states, including pacman for kernel management, mkinitcpio for initramfs generation, and limine-update for bootloader configuration. It also references local scripts in ~/scripts/, including a 'destructive' rollback script.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to parse and modify user-controlled data from Steam configuration files and system bootloader settings.\n
- Ingestion points: Data is read from ~/.steam/steam/userdata/*/config/shortcuts.vdf, ~/.steam/steam/config/config.vdf, and /etc/default/limine (files: SKILL.md, references/electron-gamescope-fix.md).\n
- Boundary markers (absent): There are no specific delimiters or instructions to ignore embedded natural language commands within the parsed configuration data.\n
- Capability inventory: The agent has the capability to execute shell commands with root privileges, modify system-wide services, and alter boot configurations.\n
- Sanitization (present/absent): The skill recommends using the vdf Python library for structured parsing of binary files, which provides a layer of validation, but it lacks specific sanitization for natural language instructions that might be embedded in configuration fields.\n- [DYNAMIC_EXECUTION]: The skill describes creating and executing bash wrapper scripts at runtime (e.g., ~/scripts/discord-gamescope.sh) to manage Electron application parameters and environment variables.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests the installation of the vdf Python package from a public registry (pip install vdf) to facilitate the modification of Steam configuration files.
Audit Metadata