linux-firewall-ssl
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
sudoto execute administrative commands for firewall and certificate management, which is standard for Linux system administration. - [PRIVILEGE_ESCALATION]: Requires root access to modify system security policies and access sensitive cryptographic keys in
/etc/letsencrypt/, which is explicitly declared in the skill's capability contract. - [DYNAMIC_EXECUTION]: The
sk-nft-apply.shscript dynamically generates nftables ruleset files based on user-selected profiles and applies them to the kernel. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input such as domain names, IP addresses, and port numbers.
- Ingestion points: CLI arguments passed to
sk-nft-apply.shand variable placeholders inSKILL.md. - Boundary markers: None explicitly implemented in the provided shell scripts.
- Capability inventory: Root-level modification of firewall rulesets and systemd services.
- Sanitization: Relies on syntax validation using
nft -cbefore applying changes to the live system. - [PERSISTENCE]: Configures systemd timers and services (e.g.,
certbot.timer,nftables.service) to ensure that firewall rules and certificate renewals persist across system reboots.
Audit Metadata