acidrain-security-script-hub
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to clone a repository from an untrusted source:
https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git. This source is not associated with a trusted organization or well-known service. - [PRIVILEGE_ESCALATION]: The instructions include commands to modify file system permissions, specifically using
chmod +xon downloaded PHP scripts andchmod 755on directories to enable execution. - [COMMAND_EXECUTION]: The skill uses several shell commands for environment setup and testing, including
git clone,php -S(starting a local web server), andcurlfor interaction with test endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface by processing external URLs and user-supplied parameters. It also contains many literal exploit payloads (e.g.,
<script>alert(1)</script>,'; DROP TABLE users; --,../../../etc/passwd) which could be misinterpreted by an AI agent if boundaries are not strictly maintained during the analysis of untrusted data.
Audit Metadata