infrahub-collecting-diagnostics

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the infrahub-collect binary from the vendor's official domain (infrahub.opsmill.io) as part of the tool installation process.
  • [COMMAND_EXECUTION]: Uses shell commands to install the utility and execute subcommands for environment detection and diagnostic bundle creation.
  • [PRIVILEGE_ESCALATION]: Requests sudo permissions to move the downloaded binary to /usr/local/bin/ for system-wide access, which is a standard procedure for installing CLI tools on Unix-like systems.
  • [DATA_EXFILTRATION]: Collects system logs, configurations, and potentially database queries into a diagnostic bundle. The skill mitigates exposure risks by requiring the user to manually review and approve the content before it is shared externally.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Reads log files, environment metadata, and database query logs generated during the diagnostic collection process.
  • Boundary markers: The workflow includes explicit user-gates requiring verification of the collected data before any sharing occurs.
  • Capability inventory: The skill utilizes Bash for running the collection tool and Write for potential manual redactions by the user.
  • Sanitization: Instructions mandate that the user manually review and redact sensitive data like passwords or customer identifiers from the logs before hand-off.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 10:10 AM