c-system
Warn
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system-level tasks via the
m-cliutility, including modifying firewall settings and managing system power (restart/shutdown). Documentation indicates that several of these operations requiresudoprivileges, granting the agent elevated administrative permissions. - [CREDENTIALS_UNSAFE]: The command
m wifi connect SSID PASSWORDprocesses WiFi passwords as plaintext command-line arguments, which can be exposed in the system's process list or shell history logs. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from WiFi scans (
m wifi scan) and incorporates it into shell commands without proper sanitization or boundary markers.
Audit Metadata