model-download-user
Fail
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides a quick-start alternative in SKILL.md that downloads a shell script from a remote GitHub repository and immediately executes it in the current shell environment using the source command.
- Evidence: 'curl -sSLO https://raw.githubusercontent.com/open-edge-platform/edge-ai-libraries/main/microservices/model-download/scripts/get_model.sh' followed by 'source ./get_model.sh' in the quick alternative section of SKILL.md.
- [REMOTE_CODE_EXECUTION]: Multiple instructions direct the agent to pipe data retrieved via curl from a network service (running on localhost) directly into the python3 interpreter for value extraction or formatting.
- Evidence: 'JOB_ID=$(echo "$JOB_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['job_ids'][0])")' in SKILL.md.
- Evidence: 'watch -n 5 "curl -s http://localhost:8200/api/v1/jobs/$JOB_ID | python3 -m json.tool"' in SKILL.md.
- Evidence: 'curl -s http://localhost:8200/api/v1/models/results | python3 -m json.tool' in SKILL.md.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone the source code for the microservice from a remote GitHub repository.
- Evidence: 'git clone https://github.com/open-edge-platform/edge-ai-libraries.git' in SKILL.md and service-setup.md.
- [COMMAND_EXECUTION]: The skill relies heavily on shell command execution to manage environment variables, execute setup scripts, and interact with the REST API.
- Evidence: Use of 'source scripts/run_service.sh up', 'export HUGGINGFACEHUB_API_TOKEN', and various 'curl' commands throughout the documentation.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes and acts upon data retrieved from a local API service which may be influenced by external model metadata.
- Ingestion points: API responses from 'http://localhost:8200/api/v1/jobs/', 'results', and 'plugins' endpoints in SKILL.md.
- Boundary markers: Absent; responses are piped directly to interpreters without delimiters.
- Capability inventory: Shell command execution, remote script sourcing, and Python code execution.
- Sanitization: Absent; no evidence of validation or sanitization before piping network data to the Python interpreter.
Recommendations
- HIGH: Downloads and executes remote code from: http://localhost:8200/api/v1/jobs/$JOB_ID, http://localhost:8200/api/v1/models/jobs?model_name=, http://localhost:8200/api/v1/models/results - DO NOT USE without thorough review
Audit Metadata