agentcookie-install
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches pre-compiled binaries and source code from the author's GitHub repository (github.com/mvanhorn/agentcookie).
- [PRIVILEGE_ESCALATION]: Utilizes sudo to move the downloaded binary into system-wide executable paths (/usr/local/bin).
- [PERSISTENCE_MECHANISMS]: Configures a systemd user service (~/.config/systemd/user/agentcookie-sink.service) to ensure the cookie synchronization daemon runs continuously and restarts automatically across reboots.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The core functionality involves extracting sensitive Chrome cookies from the source machine and transmitting them to a remote sink machine. This behavior creates a pathway for persistent credential exfiltration.
- [REMOTE_CODE_EXECUTION]: Instructs the agent to use SSH to connect to remote machines and perform installation and configuration steps.
- [COMMAND_EXECUTION]: Performs various shell operations, including manual background process management, file polling for pairing data, and automated configuration editing using sed.
Audit Metadata