setup
Fail
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes installation scripts from well-known sources (Docker and NodeSource) to automate environment setup.\n- [COMMAND_EXECUTION]: Modifies system-level configurations and permissions using administrative privileges (sudo) to facilitate Docker socket access and software installation.\n- [COMMAND_EXECUTION]: Implements persistence mechanisms by installing and loading background services via macOS LaunchAgents and Linux systemd units.\n- [PROMPT_INJECTION]: Processes user-supplied inputs, such as GitHub usernames and file system paths, which are interpolated into shell commands and configuration files, creating an indirect prompt injection surface.\n
- Ingestion points: User input for GitHub username and directory paths for mount allowlists in SKILL.md.\n
- Boundary markers: No explicit delimiters or instructions are used to isolate user-provided data from command syntax.\n
- Capability inventory: Shell command execution (git, bash, sudo) and background service management across the setup process.\n
- Sanitization: No evidence of validation or sanitization for interpolated user strings is present in the instruction set.
Recommendations
- HIGH: Downloads and executes remote code from: https://get.docker.com - DO NOT USE without thorough review
Audit Metadata