headscale-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The install-headscale.sh script downloads the Headscale binary directly from its official GitHub repository (github.com/juanfont/headscale). This follows the [TRUST-SCOPE-RULE] as GitHub is a well-known service and the repository is the authoritative source for the project.
  • [COMMAND_EXECUTION]: The skill uses standard system commands for deployment tasks, such as systemctl for service management, docker compose for container orchestration, and useradd for creating a dedicated system user. These are expected behaviors for a deployment skill.
  • [PRIVILEGE_ESCALATION]: Installation scripts require root or sudo access to perform actions like writing to /usr/local/bin, managing systemd units in /etc/systemd/system/, and creating system users. These are necessary and documented prerequisites for server software installation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 02:38 AM
Security Audit — agent-trust-hub — headscale-deploy