spoof-suite-hardware-identity
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation process requires cloning a repository from an unverified GitHub user (
Shantanu-U69) and executing build commands, kernel module installations (modprobe), and Python setup scripts with system-level privileges. - [PRIVILEGE_ESCALATION]: Almost all described operations require
sudoor Administrator privileges. The skill installs kernel modules, Windows drivers, modifies machine-level environment variables, and assigns powerful network capabilities (cap_net_admin,cap_net_raw) to binaries. - [EXTERNAL_DOWNLOADS]: The Windows installation instructions direct users to download and execute binary archives and driver installation scripts from an unverified GitHub Pages site (
shantanu-u69.github.io). - [INDIRECT_PROMPT_INJECTION]: The skill includes an AI integration component (
LLMProfileGenerator) that processes acontextdictionary to generate hardware profiles. This creates an attack surface for indirect prompt injection if the ingested context contains untrusted data. - Ingestion points: The
contextparameter inLLMProfileGenerator.generate_profileand local YAML profile paths. - Boundary markers: None identified in the provided instructions or examples.
- Capability inventory: Kernel-level network spoofing (ARP, DNS, SNI), MAC address manipulation, file system writes for profile management, and driver installation.
- Sanitization: While a
ProfileValidatoris mentioned, its efficacy is limited to schema validation rather than sanitizing natural language inputs. - [COMMAND_EXECUTION]: The skill relies heavily on the execution of shell commands and scripts to manage daemons, interfaces, and system configurations under elevated privileges.
Recommendations
- AI detected serious security threats
Audit Metadata