fastcopy-file-transfer-optimization
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a binary executable from an unverified domain (
example.com/fastcopy-linux-x64) usingcurl. This is a high-risk activity as it bypasses official package managers and trusted repositories. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of unverified binaries by providing instructions to download, set executable permissions (
chmod +x), and move them into the system path (/usr/local/bin/). - [COMMAND_EXECUTION]: The YAML profile structure and configuration examples support arbitrary shell command execution through various hooks (
on_start,on_complete,on_error). These hooks allow for unrestricted command execution as a side effect of running file transfers. - [CREDENTIALS_UNSAFE]: The documentation includes environment variable examples (
OPENAI_API_KEY,ANTHROPIC_API_KEY) that encourage the hardcoding or exposure of sensitive API keys in the environment, including literal prefixes (sk-...,sk-ant-...). - [PRIVILEGE_ESCALATION]: The skill frequently suggests the use of
sudofor installation and handling permission errors, which could lead to privilege escalation if combined with the arbitrary command hooks mentioned above.
Recommendations
- AI detected serious security threats
Audit Metadata