command-center
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The server utilizes shell-based execution (child_process.exec) in 'src/utils.js' to gather system information such as CPU load and disk usage for display on the dashboard.
- [DATA_EXFILTRATION]: Provides API access to private agent session transcripts containing full user conversation history. The cerebro status endpoint ('/api/cerebro/topic/:topicId/status') uses an unsanitized 'topicId' parameter in 'src/cerebro.js' which may allow directory traversal attacks if an attacker targets existing directories.
- [PRIVILEGE_ESCALATION]: Monitoring and setup components utilize 'sudo' commands to install system-level packages ('scripts/setup.sh') and access restricted hardware telemetry data on macOS ('src/vitals.js').
- [DYNAMIC_EXECUTION]: Implements dynamic ESM module loading in 'src/jobs.js' to initialize its jobs API and executes shell command strings constructed at runtime from the 'system-deps.json' configuration file.
- [EXTERNAL_DOWNLOADS]: Setup and installation scripts ('scripts/setup.sh' and 'scripts/install-system-deps.sh') initiate downloads of software and dependencies from external package registries and binary sources.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted interaction history. 1. Ingestion points: session transcripts (src/sessions.js). 2. Boundary markers: Absent. 3. Capability inventory: Shell execution (src/utils.js) and file writes (src/cerebro.js). 4. Sanitization: Frontend HTML escaping is present, but backend input filtering for transcript-derived content is absent.
Audit Metadata