octop-assistant

Fail

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides installation commands that fetch and execute scripts from a Tencent Cloud Object Storage bucket (finnie-1258344699.cos.ap-guangzhou.myqcloud.com) using shell pipes (curl | bash and irm | iex). While this source is associated with the vendor's infrastructure, the pattern itself bypasses traditional package verification steps.
  • [COMMAND_EXECUTION]: The skill instructions allow the agent to manage the Octop instance through a comprehensive set of CLI commands. This includes service management (start, stop, reload), user administration, model configuration, and system updates (octop update -y).
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through its ingestion of local data sources.
  • Ingestion points: The skill reads configuration and environment variables from the global ~/.octop/env file and Agent-specific .env files.
  • Boundary markers: The skill does not implement specific delimiters or instructions to prevent the agent from obeying instructions that might be embedded within these configuration files.
  • Capability inventory: The agent has significant system influence through the octop CLI, including the ability to modify server settings and execute updates.
  • Sanitization: No sanitization or validation procedures are defined for the content retrieved from environment files before it is processed by the agent.
Recommendations
  • HIGH: Downloads and executes remote code from: https://finnie-1258344699.cos.ap-guangzhou.myqcloud.com/octop/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 5, 2026, 09:12 PM