Skills
Navigate
skills/reason-machines/security-skills/avira-security-loader-2026-deployment/Gen Agent Trust Hub

avira-security-loader-2026-deployment

Fail

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download an executable (Avira-Internet-Security-2026.exe) from a personal GitHub Pages domain (jasonkrause1976.github.io) rather than the official vendor's website.
  • [REMOTE_CODE_EXECUTION]: Multiple PowerShell scripts provided in the skill automate the execution of the downloaded binary using Start-Process with various command-line arguments.
  • [COMMAND_EXECUTION]: The script create-scheduled-deployment.ps1 establishes persistence by creating a Windows Scheduled Task that runs with SYSTEM privileges and a Highest run level.
  • [COMMAND_EXECUTION]: The skill uses the -ExecutionPolicy Bypass parameter to circumvent local PowerShell security restrictions during automated task execution.
  • [COMMAND_EXECUTION]: The Invoke-AsAdmin function explicitly requests administrative elevation using the RunAs verb, which can lead to unauthorized privilege escalation if executed by a user or agent without oversight.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 4, 2026, 08:06 PM
Security Audit — agent-trust-hub — avira-security-loader-2026-deployment