managed-model-endpoints
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a process for generating and registering shell scripts that use Docker to manage container lifecycles (
docker run,docker stop,docker rm). These scripts perform operations on the host's container runtime and local filesystem (e.g., managing cache directories and permissions). - [REMOTE_CODE_EXECUTION]: The registration workflow includes pulling Docker images from external registries via
docker pull. Since the image sources are provided by external 'runbook' skills, this creates a path for executing arbitrary containerized code if a malicious or compromised runbook is processed. - [PROMPT_INJECTION]: The skill is designed to ingest configuration parameters (such as image names, ports, and readiness routes) from other skills. This architecture is vulnerable to indirect prompt injection, where malicious data in a runbook could be interpolated into the generated shell scripts to perform unauthorized actions. This risk is partially mitigated by a requirement for user approval before a script is registered.
Audit Metadata