fiddler-download-setup
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches installation manifests and application binaries from official product domains including
downloads.getfiddler.comandagent-downloads.getfiddler.com. - [REMOTE_CODE_EXECUTION]: Downloads and executes application installers in
.pkg,.AppImage, and.exeformats from remote vendor servers. The skill also suggests downloading and invoking a secondary configuration skill from the vendor's GitHub repository. - [PRIVILEGE_ESCALATION]: Utilizes
osascriptwithadministrator privilegeson macOS to execute the system installer for the downloaded package. This action triggers a native operating system authentication dialog for the user to authorize the installation. - [COMMAND_EXECUTION]: Employs shell and PowerShell commands to check for existing installations, manage file downloads, perform environment detection, and launch the Fiddler application across different platforms.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of remote YAML manifests to determine versioning information.
- Ingestion points: Fetches
latest.ymlfiles viacurlorInvoke-WebRequestfrom remote servers. - Boundary markers: None present in the instructions.
- Capability inventory: Includes file writing, process creation, network requests, and elevated execution privileges.
- Sanitization: Uses specific string matching tools like
grepandawk, as well as regular expressions, to isolate version strings from the downloaded content.
Audit Metadata