companion-clis
Warn
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPRIVILEGE_ESCALATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute a community-developed storage tool from an external third-party GitHub repository (justinwlin/Runpod-Network-Volume-Storage-Tool). The process involves cloning the source code, synchronizing dependencies via uv sync, and running the application using uv run.
- [EXTERNAL_DOWNLOADS]: Fetches installers and setup scripts from well-known official sources, including HuggingFace (hf.co), Amazon AWS (awscli.amazonaws.com), and GitHub (cli.github.com).
- [DATA_EXFILTRATION]: Instructions direct the user to manage credentials and configuration within sensitive local file paths, including SSH keys (
/.ssh/id_ed25519), AWS credentials (/.aws/credentials), Docker configuration (/.docker/config.json), and HuggingFace tokens (/.cache/huggingface/token). - [PRIVILEGE_ESCALATION]: Installation steps for the CLIs require administrative or superuser privileges, involving the use of sudo for installer execution and wsl --install which requires Administrator access on Windows.
Audit Metadata