install-xray-reality

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes the official Xray installation script from the community's GitHub repository. It includes explicit instructions for the agent to inspect the script content and verify the source before execution to mitigate supply-chain risks.
  • [COMMAND_EXECUTION]: Executes administrative commands for system maintenance, including service management with systemd, firewall policy configuration using UFW, and network diagnostics via ss and openssl.
  • [EXTERNAL_DOWNLOADS]: Fetches components from GitHub and references reputable third-party technical resources (e.g., bgp.tools, myip.ms) to perform network discovery and target selection. These are handled in a manner consistent with legitimate technical deployment workflows.
  • [DATA_EXFILTRATION]: Generates cryptographic identifiers and keys locally on the server. The skill contains strict rules against exposing server private keys or sensitive credentials in project files, logs, or client-side output, ensuring that only necessary public parameters are shared.
  • [PROMPT_INJECTION]: The skill processes data from external diagnostic websites to assist in server target selection.
  • Ingestion points: references/target-selection.md (Outputs from external network diagnostic services).
  • Boundary markers: None explicitly defined for the external site outputs, though the skill relies on manual verification.
  • Capability inventory: Full administrative access for service management, file system modifications, and network diagnostics across all provided references.
  • Sanitization: Relies on structured validation steps (e.g., xray run -test) and explicit agent instructions to verify data before applying changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 06:07 AM
Security Audit — agent-trust-hub — install-xray-reality