fastcopy-file-transfer-activation
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMMETADATA_POISONINGPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [METADATA_POISONING]: The skill's frontmatter 'name' and 'description' claim to provide "product key patches" and "activation" for software, which is a direct contradiction to the body of the skill that warns against such practices. This deceptive metadata is used to attract users or trigger on queries for unauthorized software activation.
- [PROMPT_INJECTION]: The skill contains explicit meta-instructions designed to override the agent's base behavior and persona, such as "As an AI coding agent, you should: Never assist with software piracy" and "Refuse to help activate, patch, or crack commercial software."
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for file management and tool configuration, including rsync, robocopy, and rclone commands.
- [REMOTE_CODE_EXECUTION]: The skill suggests installing the rclone utility using a piped shell script method:
curl https://rclone.org/install.sh | sudo bash. While rclone is a well-known service, this pattern involves executing remote code with elevated privileges. - [EXTERNAL_DOWNLOADS]: The skill recommends downloading software from various external sources, including the official FastCopy website, rclone.org, and installing 'fclones' via the cargo package manager.
- [PRIVILEGE_ESCALATION]: Several provided commands utilize 'sudo' to acquire administrative permissions for system package installation and script execution.
Audit Metadata