roadbook
Fail
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads binary executables directly from a GitHub repository (github.com/mnhkahn/cyeam-cli) during the installation phase.
- [REMOTE_CODE_EXECUTION]: The installation process involves downloading a remote archive, extracting it, and immediately assigning execution permissions (chmod +x) to the resulting binary.
- [COMMAND_EXECUTION]: The skill requires the use of 'sudo' to move binaries into system-level directories (/usr/local/bin/), which is a privilege escalation pattern. It also executes multiple shell commands to interact with the local filesystem and the cyeam CLI.
- [DATA_EXFILTRATION]: The skill's primary function involves uploading user data, such as travel itineraries and CSV lists, to external endpoints (Microsoft OneDrive and cyeam.com) to generate shareable links.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted user input (itinerary details) and piping it directly into shell commands via 'printf'.
- Ingestion points: User-provided itinerary details and CSV text (SKILL.md, Step A3/A4).
- Boundary markers: None present to distinguish user data from command structure.
- Capability inventory: Subprocess execution via shell pipes, file system access, and network operations (SKILL.md).
- Sanitization: No evidence of escaping or validation of user-provided strings before shell interpolation.
Recommendations
- AI detected serious security threats
Audit Metadata