sccmhunter-install-local
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones the source code for SCCMHunter from a third-party repository at
https://github.com/garrettfoster13/sccmhunter.gitto the local environment.- [REMOTE_CODE_EXECUTION]: The workflow involves two steps that execute external code: first, it installs dependencies from the downloadedrequirements.txtfile, and second, it executes the main tool scriptsccmhunter.pyto verify the installation.- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where malicious instructions in external data could influence the agent's behavior. - Ingestion points: The agent processes the contents of the third-party
requirements.txtfile during installation and reads the terminal output from executingsccmhunter.py -h. - Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from interpreting instructions that might be embedded in the tool's output or configuration files.
- Capability inventory: The skill has permissions to clone repositories, create virtual environments, install packages via pip, and execute Python scripts via the shell.
- Sanitization: The skill does not include steps to verify the integrity of the downloaded code or sanitize the output before it is processed by the agent.
Audit Metadata