managing-dev-servers
Fail
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill instructs the agent to execute a command with elevated privileges using
sudo(sudo -E HOME="$HOME" caddy trust) to modify system-wide certificate trust settings.\n- [PERSISTENCE]: Thelt dev installcommand is documented to create and bootstrap a persistent service (LaunchAgent on macOS or systemd-user unit on Linux) namedtech.lenne.lt-dev-caddyto manage the Caddy process across sessions.\n- [COMMAND_EXECUTION]: The skill relies on various shell commands for process control and environment management, including the use ofpkill -fto terminate processes by name, which can affect processes outside the current project scope.\n- [EXTERNAL_DOWNLOADS]: Recommends the installation of external third-party software such ascaddyandcloudflaredvia Homebrew (brew install).\n- [DYNAMIC_EXECUTION]: Provides a bash loop example that usesnode -eto execute a JavaScript string to parse JSON output from the GitLab CLI (glab api).\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: Polling GitLab MR pipeline statuses via
glab api(SKILL.md).\n - Boundary markers: None present; output is piped directly to a parser.\n
- Capability inventory: Access to
sudo, persistence mechanisms, and broad command execution (pkill).\n - Sanitization: No specific sanitization or validation of the external API response is mentioned before parsing.\n- [DATA_EXFILTRATION]: The
lt dev tunnelcommand creates a public Cloudflare Quick Tunnel to expose local development servers to the internet, potentially leading to the accidental exposure of sensitive local data or services to external parties.
Recommendations
- AI detected serious security threats
Audit Metadata