wireguard
Fail
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes the Pi-hole installation script from its official domain 'install.pi-hole.net' via a pipe to bash to facilitate DNS integration.
- [PRIVILEGE_ESCALATION]: Performs administrative actions including installing system packages, modifying kernel network parameters via '/etc/sysctl.conf', and adjusting system firewall rules using 'ufw'.
- [COMMAND_EXECUTION]: Generates a shell script named 'add-peer.sh' that performs cryptographic key generation, file system operations in '/etc/wireguard', and QR code generation.
- [PERSISTENCE]: Configures the WireGuard interface as a systemd service ('wg-quick@wg0') to ensure the VPN tunnel automatically starts during system boot.
- [INDIRECT_PROMPT_INJECTION]: The provisioning script ('add-peer.sh') accepts user-provided peer names which are interpolated into configuration files and file paths without sanitization.
- Ingestion points: User-supplied peer name argument in 'add-peer.sh' (SKILL.md).
- Boundary markers: None present.
- Capability inventory: Execution of 'wg' tools, file writes to system configuration directories, and generation of QR codes.
- Sanitization: None; input is used directly as a shell variable in file paths and configuration comments.
Recommendations
- HIGH: Downloads and executes remote code from: https://install.pi-hole.net - DO NOT USE without thorough review
Audit Metadata