shortcut-share-file

Warn

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DATA_EXFILTRATION]: The skill explicitly instructs the agent to perform 'Zero processing and zero checking' (零处理零检查), specifically avoiding verification of file contents or existence before proceeding. This policy, combined with the command to copy files from arbitrary source paths into a public iCloud sharing directory, creates a significant risk where sensitive system files or credentials (e.g., SSH keys, .env files) could be exposed if the agent is manipulated via user input.
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to facilitate its workflow:
  • It uses iperf3 to perform network speed tests against an external server (ping.online.net).
  • It uses cp to move files across the filesystem.
  • It executes inline Python code (python3 -c) to parse JSON output from the speed test.
  • [EXTERNAL_DOWNLOADS]: The skill relies on an external iOS Shortcut hosted on Apple's iCloud domain (https://www.icloud.com/shortcuts/...) to perform the final sharing action. While the source is a well-known service, the shortcut itself is a remote dependency that executes logic on the user's device.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 16, 2026, 07:10 AM
Security Audit — agent-trust-hub — shortcut-share-file