free-offer-brief

Warn

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is configured to execute several local scripts provided within its distribution folder: bin/rmbc-update-check, bin/rmbc-analytics, and /bin/rmbc-workspace. These are executed in the preamble and during user interaction to manage updates and the environment.
  • [DATA_EXFILTRATION]: The skill utilizes a background process, rmbc-analytics, to send usage data to an external service. While the skill claims no sensitive data is transmitted, it exfiltrates the active_product name, which may contain proprietary or sensitive project identifiers.
  • [REMOTE_CODE_EXECUTION]: A potential command injection vulnerability exists in the workspace activation protocol. The instruction to run /bin/rmbc-workspace active "<user's answer>" takes raw user input and interpolates it directly into a shell command without visible sanitization or validation, which could allow the execution of arbitrary commands if the user provides shell metacharacters.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 11, 2026, 01:36 PM
Security Audit — agent-trust-hub — free-offer-brief