moos-ivp-installer
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEPERSISTENCEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill modifies user shell profiles (e.g., ~/.bashrc, ~/.zshrc) to persist environment variable configurations.
- Evidence: SKILL.md Step 7 defines the workflow for appending a managed environment source block to the user shell configuration files.
- Safety: The instructions explicitly mandate asking for user confirmation before any shell profile edits are performed.
- [PRIVILEGE_ESCALATION]: The skill executes commands with elevated privileges (sudo) to install system-level dependencies.
- Evidence: SKILL.md Step 5 and 4 describe following README instructions that typically include package manager commands with sudo.
- Safety: Instructions require the agent to ask before running any package-manager or sudo commands.
- [COMMAND_EXECUTION]: The skill runs multiple shell commands for cloning, building, and validation purposes.
- Evidence: Executes git clone, build-moos.sh, build-ivp.sh, and the local validator scripts/validate_moos_ivp_install.sh.
- [EXTERNAL_DOWNLOADS]: The skill downloads source code from a public GitHub repository.
- Evidence: Targets the repository at https://github.com/moos-ivp/moos-ivp.git.
- [INDIRECT_PROMPT_INJECTION]: The skill reads and follows instructions from platform-specific README files in the external repository, creating a potential injection surface.
- Ingestion points: Platform-specific README files (README-OS-X.txt, README-GNULINUX.txt, README-WINDOWS.txt) in the cloned repository root.
- Boundary markers: None specified for the ingestion of these external text files.
- Capability inventory: Shell profile modification, sudo execution, file writing, and command execution.
- Sanitization: No sanitization of README content is performed.
- [DYNAMIC_EXECUTION]: The skill dynamically generates a shell script (env.sh) and subsequently executes it during validation.
- Evidence: SKILL.md Step 6 describes the creation of the script, and scripts/validate_moos_ivp_install.sh executes it via sourcing inside a bash sub-command.
Audit Metadata