infrahub-collecting-diagnostics

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the infrahub-collect utility from the vendor's official domain (infrahub.opsmill.io) during the installation phase.
  • Evidence: curl https://infrahub.opsmill.io/ops/$(uname -s)/$(uname -m)/infrahub-collect -o infrahub-collect documented in rules/install-and-verify.md and reference.md.
  • [COMMAND_EXECUTION]: Instructs the user to use sudo to install the binary to a system directory and use chmod to modify permissions.
  • Evidence: sudo mv infrahub-collect /usr/local/bin/ and chmod +x infrahub-collect in rules/install-and-verify.md.
  • [REMOTE_CODE_EXECUTION]: Executes the downloaded vendor binary to detect environment settings and generate diagnostic bundles.
  • Evidence: Usage of subcommands like infrahub-collect create and infrahub-collect environment detect throughout the skill workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local system logs and configuration files to assist with debugging.
  • Ingestion points: Data is read from bundle/logs/ and bundle/server/ as described in rules/bundle-layout.md.
  • Boundary markers: None explicitly used for the log content, but the skill enforces a mandatory manual review gate.
  • Capability inventory: The skill utilizes Bash, Read, Write, Grep, and Glob tools.
  • Sanitization: The infrahub-collect tool performs automated key-name masking (e.g., passwords, tokens), and the skill instructions explicitly require the user to perform a manual review and redaction of logs before sharing data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 05:32 AM
Security Audit — agent-trust-hub — infrahub-collecting-diagnostics