build-on-host
Warn
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's core functionality is to dispatch and execute arbitrary plans (tasks.md) on a remote host via various agent CLIs (grok, claude, codex, etc.) with full autonomy permissions. This is performed via SSH commands defined in SKILL.md and runner-drivers.md.
- [COMMAND_EXECUTION]: The skill frequently executes complex shell commands on a remote host using ssh and tmux. Examples include Phase 4's tmux session creation and the remote_script function in host-status.sh which pipes a bash script over SSH.
- [DYNAMIC_EXECUTION]: The templates/host-status.sh script uses the eval command on the output of a Python script that parses the host-run.json file. This pattern could allow for command injection if the local JSON record is modified or contains malicious input.
- [CREDENTIALS_UNSAFE]: The skill manages sensitive data including .env files, SSH keys (~/.ssh/id_rsa), and GitHub personal access tokens stored in ~/.config/host-build/gh-token. While it includes gates for user confirmation, these files are explicitly targeted for read/write operations.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by passing a local task plan (tasks.md) to a remote agent for execution with full autonomy. 1. Ingestion point: tasks.md (Phase 4). 2. Boundary markers: Absent. 3. Capability inventory: SSH, tmux, and full-autonomy agent execution. 4. Sanitization: Absent.
Audit Metadata