cyrus-setup
Warn
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill uses browser automation via
agent-browserto navigate to Linear, Slack, and GitHub in order to scrape credentials and automate app creation. This involves handling sensitive authentication data. - [REMOTE_CODE_EXECUTION]: The skill executes arbitrary JavaScript within a browser context using the
agent-browser evalcommand, which could be exploited if the browser is navigated to a malicious site. - [COMMAND_EXECUTION]: The skill performs low-level system operations including launching a Chrome instance with remote debugging enabled and killing processes based on port activity using
lsofandkill. - [COMMAND_EXECUTION]: The skill manages secrets in
~/.cyrus/.envusing shell redirections andgrep. While intended to keep secrets out of the LLM context, shell-based manipulation can leave traces in system logs and history. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from external web pages. Ingestion points: Web pages accessed via
agent-browser. Boundary markers: None identified. Capability inventory: Shell execution, browser automation, file reading. Sanitization: None identified. - [REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes instructions from multiple external files (
cyrus-setup-*/SKILL.md) based on user preferences and current setup state.
Audit Metadata