nomad
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official HashiCorp GPG key and adds the HashiCorp apt repository. These downloads target the official domain
apt.releases.hashicorp.comand follow standard package manager configuration practices for verifying software authenticity. - [COMMAND_EXECUTION]: The installation guide includes commands that require
sudoprivileges to install the Nomad agent and configure system repositories (apt install nomad,tee /etc/apt/sources.list.d/hashicorp.list). These are standard administrative tasks for installing system-level orchestration software. - [DATA_EXPOSURE]: The skill demonstrates secure secret management using HashiCorp Vault integration (
{{ with secret "secret/data/myapp/config" }}). It correctly avoids hardcoding actual credentials, using placeholders likedb.example.comandvault.example.comfor infrastructure references. - [PRIVILEGE_ESCALATION]: One example (
jobs/monitoring.nomad.hcl) demonstrates a system job usingnetwork_mode = "host"andpid_mode = "host". While these are high-privilege settings, they are documented as the standard configuration for anode-exportertask which requires host-level access to collect system metrics.
Audit Metadata