neuralos
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The management script
scripts/neuralos.mjsand the Windows installation scriptservice/install-windows-service.ps1execute system-level commands to manage processes and register services. This includes the use ofsudofor Linux setup and elevated PowerShell with execution policy bypasses for Windows Task Scheduler registration. - [COMMAND_EXECUTION]: The skill establishes system-wide persistence by creating and enabling system-level service units (systemd
.service, launchd.plist) and scheduled tasks to ensure the backend daemon remains active across system reboots. - [EXTERNAL_DOWNLOADS]: Setup procedures trigger package downloads from the npm registry for the
neuralosandrterm-backendpackages, as well as thewigolotool used by the web-intelligence plugin. - [REMOTE_CODE_EXECUTION]: The skill dynamically interprets and executes
daguYAML workflows by compiling them into playbooks that run across orchestrated terminal sessions. - [PROMPT_INJECTION]: The skill processes untrusted data via external YAML configurations and workflows, creating a surface for indirect prompt injection.
- Ingestion points: Processes external
daguYAML workflows viaagent:startTaskand YAML-based policies in the data directory. - Boundary markers: Instructions rely on the agent's ability to distinguish data from instructions within the task context; boundary markers are not explicitly enforced for these inputs.
- Capability inventory: The skill manages a backend with full terminal access (SSH, WinRM, local PTY) and system administration capabilities.
- Sanitization: The backend implements internal validation and rollback mechanisms for playbooks, though static analysis of input data content is not performed.
Audit Metadata