t3-remote-setup
Fail
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads an installation script from 'https://t3.codes/install.sh' and pipes it directly to the shell ('| sh') without prior validation or integrity checks.
- [COMMAND_EXECUTION]: User-provided '$ARGUMENTS' (used as the SSH host) are interpolated directly into multiple shell command strings (e.g., 'ssh ...'). If the input contains shell metacharacters, it could lead to command injection on the local system.
- [PRIVILEGE_ESCALATION]: The skill uses 'sudo -n' to attempt administrative modifications to system-level files like '/etc/machine-info' on the remote host.
- [INDIRECT_PROMPT_INJECTION]: The skill parses and acts upon the output of various remote commands (such as 'hostname', 'uname', and 't3 --version'). If the remote environment is untrusted or compromised, this output could be manipulated to influence the agent's decision-making process.
- Ingestion points: Output from remote SSH commands executed in steps 2, 4, and 5 (SKILL.md).
- Boundary markers: No explicit delimiters or instructions are used to separate untrusted remote output from the agent's internal logic.
- Capability inventory: The skill has access to network operations (SSH, curl/wget), file writes (remote /etc/machine-info), and arbitrary shell command execution.
- Sanitization: No sanitization or filtering of the remote command output is described before it is processed by the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://t3.codes/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata