infrahub-collecting-diagnostics
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
infrahub-collectutility from the vendor's official domain (infrahub.opsmill.io) during the installation phase. - Evidence:
curl https://infrahub.opsmill.io/ops/$(uname -s)/$(uname -m)/infrahub-collect -o infrahub-collectdocumented inrules/install-and-verify.mdandreference.md. - [COMMAND_EXECUTION]: Instructs the user to use
sudoto install the binary to a system directory and usechmodto modify permissions. - Evidence:
sudo mv infrahub-collect /usr/local/bin/andchmod +x infrahub-collectinrules/install-and-verify.md. - [REMOTE_CODE_EXECUTION]: Executes the downloaded vendor binary to detect environment settings and generate diagnostic bundles.
- Evidence: Usage of subcommands like
infrahub-collect createandinfrahub-collect environment detectthroughout the skill workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local system logs and configuration files to assist with debugging.
- Ingestion points: Data is read from
bundle/logs/andbundle/server/as described inrules/bundle-layout.md. - Boundary markers: None explicitly used for the log content, but the skill enforces a mandatory manual review gate.
- Capability inventory: The skill utilizes
Bash,Read,Write,Grep, andGlobtools. - Sanitization: The
infrahub-collecttool performs automated key-name masking (e.g., passwords, tokens), and the skill instructions explicitly require the user to perform a manual review and redaction of logs before sharing data.
Audit Metadata