virtualmin-templates
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: All shell scripts in the scripts/ directory (create-plan.sh, create-template.sh, delete-plan.sh, delete-template.sh, get-template.sh, list-plans.sh, list-templates.sh, modify-plan.sh, and modify-template.sh) execute the virtualmin CLI utility using sudo. This grants the AI agent root-level administrative access to the host server's hosting and configuration environment.
- [COMMAND_EXECUTION]: Several scripts, including create-plan.sh, create-template.sh, list-plans.sh, list-templates.sh, modify-plan.sh, and modify-template.sh, employ a pattern where unvalidated command-line arguments are passed directly into the sudo virtualmin command string. This allows for the injection of arbitrary Virtualmin CLI flags with elevated privileges.
Audit Metadata