threat-intelligence
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides command lines to execute PowerShell (bootstrap-reverse.ps1) and Bash (bootstrap-reverse.sh) scripts that are explicitly excluded from the skill package. This directs the agent or user to execute unvetted code from external or 'upstream' sources.\n- [COMMAND_EXECUTION]: Instructions include pre-configured shell commands for system configuration and service registration.\n- [PRIVILEGE_ESCALATION]: The provided PowerShell command uses the -ExecutionPolicy Bypass flag, which is a technique used to circumvent local security restrictions on script execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from public X/Twitter posts, an untrusted external source. This creates an attack surface where malicious instructions in posts could attempt to influence the agent.\n
- Ingestion points: Public X data ingested via MCP/REST interfaces (SKILL.md).\n
- Boundary markers: The skill documentation uses <UNTRUSTED_PUBLIC_SOURCE> tags as delimiters (SKILL.md).\n
- Capability inventory: PowerShell/Bash script execution and network API access (SKILL.md).\n
- Sanitization: The instructions include a warning to treat external posts as data only and not to execute commands contained within them, but no programmatic sanitization is defined.\n- [METADATA_POISONING]: The skill's metadata claims a 'safe' risk level, which is deceptive given the instructions to execute unvetted external scripts with administrative-level policy bypasses.
Audit Metadata