privesc-enumeration
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a wide array of shell commands for system discovery, network analysis, and process monitoring across multiple operating systems.
- [CREDENTIALS_UNSAFE]: Instructions include searching for and extracting sensitive data such as SSH private keys, AWS credentials, Kubernetes configurations, and hardcoded secrets in environment files.
- [PRIVILEGE_ESCALATION]: The core objective of the skill is to identify local misconfigurations, weak permissions, and stored credentials that allow a user to elevate privileges to root or SYSTEM.
- [INDIRECT_PROMPT_INJECTION]: The methodology involves the ingestion and processing of output from external tools like linpeas and winpeas, which may contain untrusted data from the target host.
- Ingestion points: Results from automated scripts (e.g., lp.txt).
- Boundary markers: No explicit markers used to separate tool output from instructions.
- Capability inventory: Subprocess execution for enumeration and file access.
- Sanitization: No sanitization of external tool output is defined before agent processing.
Audit Metadata