free-offer-brief
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured to execute several local scripts provided within its distribution folder:
bin/rmbc-update-check,bin/rmbc-analytics, and/bin/rmbc-workspace. These are executed in the preamble and during user interaction to manage updates and the environment. - [DATA_EXFILTRATION]: The skill utilizes a background process,
rmbc-analytics, to send usage data to an external service. While the skill claims no sensitive data is transmitted, it exfiltrates theactive_productname, which may contain proprietary or sensitive project identifiers. - [REMOTE_CODE_EXECUTION]: A potential command injection vulnerability exists in the workspace activation protocol. The instruction to run
/bin/rmbc-workspace active "<user's answer>"takes raw user input and interpolates it directly into a shell command without visible sanitization or validation, which could allow the execution of arbitrary commands if the user provides shell metacharacters.
Audit Metadata