lov-env-management
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [PERSISTENCE_MECHANISMS]: The skill modifies the user's shell configuration file (~/.zshenv) to automatically export environment variables. This occurs in scripts/env_manager.py within the sync_shell function, which inserts a sourcing block into the RC file to ensure credentials persist across sessions.
- [DYNAMIC_EXECUTION]: The script uses os.execvp to replace the current process with the macOS security command. This is used in scripts/env_manager.py to securely handle secret input via a pseudo-terminal (pty.fork), which represents a high-level process replacement capability.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill executes system commands using subprocess.run, including launchctl for macOS, systemctl for Linux user sessions, and the 1Password CLI (op). These tools are used to project environment variables into the user session or retrieve secrets from external managers.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The probe command in scripts/env_manager.py allows sending stored secrets (API keys) to a remote HTTPS URL for validation. While this is an intended feature for checking key validity, it provides a functional path for data exfiltration if the agent is provided with an attacker-controlled URL.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from platform and account names provided during CLI or Dashboard interaction. This creates an attack surface where instructions could be embedded in metadata, although the script performs basic regex validation on these identifiers.
Audit Metadata