server-security-init-skill
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages local SSH public and private keys in the ~/.ssh directory to establish secure, key-based authentication for remote server management.
- [EXTERNAL_DOWNLOADS]: The documentation provides installation instructions that reference a repository on GitHub, utilizing a standard and well-known hosting platform for software distribution.
- [COMMAND_EXECUTION]: The workflow involves executing numerous shell commands locally and remotely to configure the operating system, install security packages, and modify service listeners.
- [PRIVILEGE_ESCALATION]: The skill configures a non-root administrative user with passwordless sudo access, which is a high-privilege operation necessary for automated server maintenance.
- [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect injection. 1. Ingestion points: Server configuration variables (IP, user) and command output from remote services like ufw and ss. 2. Boundary markers: Absent. 3. Capability inventory: Extensive local and remote shell execution and system configuration rights. 4. Sanitization: Absent.
Audit Metadata