proxelar
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the "proxelar" binary via Homebrew ("brew install proxelar"). This is an external dependency necessary for the skill's core functionality.
- [PRIVILEGE_ESCALATION]: The documentation instructs the user to manually execute a "sudo" command ("sudo security add-trusted-cert ...") to add the proxy's generated CA certificate to the system keychain. This is a high-privilege prerequisite required for the tool to intercept and decrypt HTTPS traffic.
- [COMMAND_EXECUTION]: The "scripts/latency_inject.lua" script utilizes the "os.execute" function to call the system "sleep" command. This is used to simulate network latency based on configurable rules defined within the script file.
- [DATA_EXFILTRATION]: Several bundled Lua scripts ("log_to_jsonl.lua", "capture_for_eval.lua") are designed to capture and log network request and response data—including methods, URLs, headers, and bodies—to local files in the "~/.proxelar/" directory. While this is the primary intended function for debugging and evaluation, it involves recording potentially sensitive information such as authentication headers or personal data transmitted in the traffic.
Audit Metadata