busybox-on-windows
Fail
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses PowerShell's
Invoke-WebRequestto fetch multiple versions ofbusybox.exefromhttps://frippery.org/files/busybox/. This domain is an unverified third-party source not associated with the official BusyBox project or any trusted organization listed in the security guidelines. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to download the binary and then immediately execute it (e.g.,
busybox.exe --list). This establishes a chain where untrusted code from a remote server is executed on the local system. - [COMMAND_EXECUTION]: Before downloading, the skill executes PowerShell commands to gather system metadata, including CPU specifications via
Get-CimInstanceand OS version details from the Windows Registry (HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion). While these are used for compatibility checking, they represent system reconnaissance commands.
Recommendations
- AI detected serious security threats
Audit Metadata