ebpf-rust
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to use
cargo generateto fetch a project structure from the officialaya-rsrepository on GitHub. This is the standard community-accepted method for starting new projects with this framework.\n- [PRIVILEGE_ESCALATION]: Documentation specifies that running the compiled BPF program requiressudo. This is a legitimate requirement for eBPF development, as the Linux kernel restricts BPF loading to users with administrative capabilities (CAP_BPF/CAP_SYS_ADMIN).\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: Kernel-side tracepoints and tracepoint contexts defined in the code snippets.\n
- Boundary markers: None present in the simplified examples.\n
- Capability inventory: Subprocess execution via
cargo xtask, map writes/reads, and kernel tracepoint attachment.\n - Sanitization: Not applicable for these boilerplate code examples.
Audit Metadata