tailscale
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes instructions to download and execute the official Tailscale installation script from
https://tailscale.com/install.sh. This is a well-known service and the operation is documented for legitimate setup purposes. - [COMMAND_EXECUTION]: The skill uses a helper script (
scripts/ts-api.sh) and direct CLI commands to interact with the Tailscale daemon and API. These operations include checking status, pinging peers, and managing network configuration. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, specifically device lists and statuses from the Tailscale API and CLI output. While this creates a potential surface for indirect instructions if a peer device name or user email is maliciously crafted, the skill does not grant excessive privileges to this data, and standard LLM guardrails apply.
- [CREDENTIALS_SAFE]: The skill correctly instructs the user to store sensitive API keys in a local
.envfile (~/.claude-homelab/.env) rather than hardcoding them, following secret management best practices.
Audit Metadata