chaos-engineer

Warn

Audited by Gen Agent Trust Hub on Mar 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous scripts and commands intended for execution on infrastructure, including resource exhaustion, network latency injection, and container termination.
  • Evidence: references/infrastructure-chaos.md contains commands for stress-ng, iperf3, and pumba to saturate CPU, memory, and network resources.
  • Evidence: references/chaos-tools.md includes a bash script that uses aws ec2 terminate-instances to simulate Chaos Monkey behavior.
  • [PRIVILEGE_ESCALATION]: Several provided scripts require administrative privileges (sudo) to modify system configurations or install tools.
  • Evidence: references/infrastructure-chaos.md uses sudo apt-get install -y stress-ng to install testing tools.
  • Evidence: references/infrastructure-chaos.md uses sudo sh -c 'echo "127.0.0.1 {domain}" >> /etc/hosts' to simulate DNS failures by modifying system network files.
  • [EXTERNAL_DOWNLOADS]: The skill automates the download and application of Kubernetes manifests from remote sources.
  • Evidence: references/chaos-tools.md contains a command to kubectl apply a manifest directly from https://litmuschaos.github.io/litmus/litmus-operator-v2.14.0.yaml.
  • [INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect injection by processing data from external monitoring systems and infrastructure APIs without explicit sanitization patterns.
  • Ingestion points: references/chaos-tools.md (Prometheus API), references/kubernetes-chaos.md (Kubernetes API).
  • Boundary markers: Absent.
  • Capability inventory: references/infrastructure-chaos.md (subprocess.run), references/chaos-tools.md (sh execution in Jenkins/GitHub Actions).
  • Sanitization: Absent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 27, 2026, 07:23 AM