doctor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
mvsetup.pyto perform diagnostic checks on system dependencies and to scaffold configuration files. - [PRIVILEGE_ESCALATION]: The instructions include the use of
sudofor installingffmpegvia package managers (apt-get,dnf) on Linux. This privileged operation is gated by a requirement to obtain user permission through theAskUserQuestiontool prior to execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could potentially contain untrusted content.
- Ingestion points: The skill reads JSON-formatted status reports from the
mvsetup.pyscript and collects API keys directly from the user viaAskUserQuestion. - Boundary markers: The agent is instructed to summarize the status and report back to the user rather than autonomously acting on the ingested data.
- Capability inventory: The skill possesses
Bashexecution capabilities and access to the local filesystem for writing configuration files. - Sanitization: While no specific input sanitization is mentioned, the instructions specify that API keys should be written to a restricted
.envfile and never printed or committed to version control.
Audit Metadata