vm-cleanup
Warn
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous templates for executing recursive deletion commands (
rm -rf) on system paths (e.g.,/tmp,/var/cache/apt/archives) and user directories across the/sessionsmount. - [COMMAND_EXECUTION]: In Cowork environments, the skill instructs the agent to utilize
mcp__Desktop_Commander__start_processto execute shell commands directly on the host Mac filesystem, which allows operations to escape the VM sandbox. - [COMMAND_EXECUTION]: The instructions suggest setting up a persistence mechanism by recommending the creation of a scheduled task that runs every two hours for recurring maintenance.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-controlled data (such as usernames and project paths) into shell commands executed on the host machine.
- Ingestion points: User-provided project names and filesystem paths within the SKILL.md instructions.
- Boundary markers: Absent; the skill does not implement delimiters or 'ignore' instructions for the processed paths.
- Capability inventory: Recursive file deletion (
rm -rf), host command execution via MCP (mcp__Desktop_Commander__start_process), and system-wide file searching. - Sanitization: Absent; the skill does not specify any validation or escaping for paths before execution.
Audit Metadata