sre-engineer
Fail
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts that use subprocess.run to execute system-level commands like kubectl rollout, df, and find for automation purposes.
- [DYNAMIC_EXECUTION]: In references/automation-toil.md, the AutomatedRunbook class executes commands using shell=True, which is a significant security risk as it can lead to command injection if variables are not properly sanitized.
- [PRIVILEGE_ESCALATION]: The skill includes scripts that attempt to manage system services via systemctl and modify network configurations with iptables, which are high-privilege operations.
- [EXTERNAL_DOWNLOADS]: A script in SKILL.md fetches metrics from a network endpoint (http://prometheus:9090) and uses the result to trigger system-level subprocess calls, a pattern identified as a remote code execution threat by automated scanners.
- [INDIRECT_PROMPT_INJECTION]: The skill lacks sanitization for data ingested from Prometheus or CLI arguments before interpolation into shell commands, creating a potential vector for indirect prompt injection.
Recommendations
- HIGH: Downloads and executes remote code from: http://prometheus:9090/api/v1/query?query={urllib.request.quote(query)} - DO NOT USE without thorough review
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata