Skills
Navigate
skills/nousresearch/hermes-agent/minecraft-modpack-server/Gen Agent Trust Hub

minecraft-modpack-server

Warn

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONPERSISTENCEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads a ZIP archive from a user-provided URL and executes a shell script (startserver.sh) found inside, which allows for the execution of untrusted remote code.
  • [EXTERNAL_DOWNLOADS]: The skill fetches external ZIP archives from arbitrary URLs.
  • [PRIVILEGE_ESCALATION]: The skill uses sudo to perform system-level tasks including software installation and firewall modification.
  • [PERSISTENCE]: The skill automatically installs a recurring task in the user's crontab for backup management.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates shell scripts (start-minecraft.sh and backup.sh) and grants them execution permissions.
  • [COMMAND_EXECUTION]: The skill executes shell commands directly on the host system to perform installation and configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface by processing remote data from a ZIP archive and executing its contents without validation.
  • Ingestion points: Remote ZIP download via wget in SKILL.md.
  • Boundary markers: None present.
  • Capability inventory: Shell script execution, sudo access, file system modification, and crontab updates.
  • Sanitization: No verification of the downloaded archive's contents or script integrity is performed.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 2, 2026, 04:02 PM