sre-engineer

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to interact with cluster and system management tools.
  • Scripts in SKILL.md and references/automation-toil.md execute 'kubectl rollout restart' to remediate service errors.
  • Chaos engineering patterns in references/incident-chaos.md execute 'iptables' and 'tc' to simulate network failures and latency.
  • The AutomatedRunbook class in references/automation-toil.md uses shell=True to execute runbook steps.
  • [PRIVILEGE_ESCALATION]: Several scripts perform actions that typically require administrative permissions.
  • The SelfHealer class in references/automation-toil.md includes methods for restarting system services (systemctl restart) and deleting log files (find /var/log ... -delete).
  • Network manipulation commands in references/incident-chaos.md (e.g., 'tc qdisc add', 'iptables -A OUTPUT') require elevated network privileges.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with external and internal endpoints to fetch metrics and documentation.
  • Fetches error rate data from an internal Prometheus server (http://prometheus:9090) to determine if auto-remediation is necessary.
  • Links to external documentation on the author's GitHub Pages site (jeffallan.github.io).
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where external metrics influence automated infrastructure changes.
  • Ingestion points: Reads metrics data from Prometheus API responses in SKILL.md.
  • Capability inventory: Significant capabilities including kubectl, systemctl, iptables, and tc are available.
  • Boundary markers: The scripts use specific logic (e.g., float comparison) to limit the impact of external data.
  • Sanitization: Prometheus queries are URL-encoded.
Recommendations
  • HIGH: Downloads and executes remote code from: http://prometheus:9090/api/v1/query?query={urllib.request.quote(query)} - DO NOT USE without thorough review
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 14, 2026, 09:35 PM
Security Audit — agent-trust-hub — sre-engineer