cyrus-setup-launch

Warn

Audited by Gen Agent Trust Hub on Apr 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes administrative commands using sudo to install a Root CA certificate into the system keychain on macOS (security add-trusted-cert) and Linux (update-ca-certificates). This modification of system-wide trust stores is a sensitive operation.
  • [COMMAND_EXECUTION]: The skill uses sudo to create and configure a system-level service at /etc/systemd/system/cyrus.service and manages its lifecycle via systemctl (daemon-reload, enable, start).
  • [COMMAND_EXECUTION]: The skill configures persistence using the pm2 process manager, including executing pm2 startup which typically requires the agent to run generated administrative commands with elevated privileges.
  • [EXTERNAL_DOWNLOADS]: The skill performs a global installation of the pm2 utility using the Node.js package manager (npm install -g pm2).
  • [CREDENTIALS_UNSAFE]: The skill accesses sensitive file paths including ~/.cyrus/.env and ~/.cyrus/config.json. While it attempts to mitigate exposure by using grep -c to count occurrences of secrets rather than printing them, it directly extracts the CYRUS_BASE_URL and reads the entire configuration file into context.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 17, 2026, 02:30 PM