elephant-agent-personal-ai
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation instructions recommend a command that downloads a script from 'https://elephant.agentic-in.ai/install.sh' and pipes it directly into the bash shell. This execution pattern is highly risky as it runs arbitrary remote code without prior verification of the script content.
- [DYNAMIC_EXECUTION]: The Python API examples include a 'GitSkill' implementation that uses 'subprocess.run' to execute system commands. While the specific example uses a command whitelist (status, log, diff, branch), the pattern of spawning subprocesses from logic governed by the agent poses a risk of command injection if input parameters are not strictly sanitized.
- [INDIRECT_PROMPT_INJECTION]: The skill provides capabilities for the agent to ingest data from untrusted external sources via the 'BrowserSkill' and 'FileSystemSkill'. This creates an attack surface where instructions hidden in web pages or documents could be parsed and executed by the agent.
- Ingestion points: Web content retrieved via 'BrowserSkill', local file contents read via 'FileSystemSkill', and external model lenses.
- Boundary markers: None identified in the provided documentation or code snippets.
- Capability inventory: Subprocess execution ('GitSkill'), file system writes ('model.save()'), and automated web browsing ('BrowserSkill').
- Sanitization: The 'GitSkill' snippet shows basic command whitelisting, but there is no evidence of broad sanitization for data flowing from the browser or filesystem into the agent's reasoning process.
Recommendations
- HIGH: Downloads and executes remote code from: https://elephant.agentic-in.ai/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata