quip-node-manager
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides installation commands that pipe remote scripts from an unverified GitLab repository directly to shell interpreters (
shandiex). This practice allows for the execution of arbitrary code without integrity checks. - [COMMAND_EXECUTION]: The Rust backend relies on
std::process::Commandto invoke system tools such asdockerandnvidia-smito manage node processes. - [PRIVILEGE_ESCALATION]: The documentation instructs users to manually bypass security protections, including the macOS quarantine attribute via
xattrand Windows SmartScreen alerts. It also utilizessudofor certificate management and package installation. - [CREDENTIALS_UNSAFE]: The system manages sensitive credentials, including a node secret, TLS private keys, and a D-Wave API token, all of which are referenced or stored within the local filesystem at
~/quip-data/. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion point:
src-tauri/src/node.rs(stream_logs) reads logs from external node processes. 2. Boundary markers: None are defined. 3. Capability inventory: System command execution and file writing. 4. Sanitization: No validation or escaping is performed on the log output before it is emitted to the application context. - [EXTERNAL_DOWNLOADS]: The application downloads Docker images, node binaries, and configuration files from external sources during setup and automated updates.
Recommendations
- HIGH: Downloads and executes remote code from: https://gitlab.com/quip.network/quip-node-manager/-/raw/main/scripts/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata