cyrus-setup-launch
Warn
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes administrative commands using
sudoto install a Root CA certificate into the system keychain on macOS (security add-trusted-cert) and Linux (update-ca-certificates). This modification of system-wide trust stores is a sensitive operation. - [COMMAND_EXECUTION]: The skill uses
sudoto create and configure a system-level service at/etc/systemd/system/cyrus.serviceand manages its lifecycle viasystemctl(daemon-reload, enable, start). - [COMMAND_EXECUTION]: The skill configures persistence using the
pm2process manager, including executingpm2 startupwhich typically requires the agent to run generated administrative commands with elevated privileges. - [EXTERNAL_DOWNLOADS]: The skill performs a global installation of the
pm2utility using the Node.js package manager (npm install -g pm2). - [CREDENTIALS_UNSAFE]: The skill accesses sensitive file paths including
~/.cyrus/.envand~/.cyrus/config.json. While it attempts to mitigate exposure by usinggrep -cto count occurrences of secrets rather than printing them, it directly extracts theCYRUS_BASE_URLand reads the entire configuration file into context.
Audit Metadata