luxonis-device-setup
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions include a reference to an official shell script installer (
oakctl-installer.sh) from the vendor's release domain. The instructions explicitly direct the agent to ask the user to run the command themselves rather than executing it silently. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of management tools and Python libraries (
depthai) from official vendor-owned domains (luxonis.comsubdomains) to enable hardware functionality. - [COMMAND_EXECUTION]: The agent performs local environment discovery and hardware diagnostics using Python imports and CLI tools (
oakctl) to identify connected OAK devices. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where it processes hardware and host-level facts during its discovery phase.
- Ingestion points: System discovery data including OS details, hardware IDs, and network environment clues.
- Boundary markers: Absent.
- Capability inventory: Isolated package installation (
pip), hardware CLI interaction, and local file creation (DEVICE.md). - Sanitization: Standard discovery output is used without specialized filtering for potential injection patterns.
Audit Metadata