virtualmin-webapps
Fail
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires administrative access and explicitly instructs the user (or agent) to execute scripts using
sudo bash. - [COMMAND_EXECUTION]: The provided shell scripts use
sudoto call thevirtualminutility, granting the skill high-privilege access to the host system. - [COMMAND_EXECUTION]: Shell scripts in the
scripts/directory pass user-supplied arguments to system commands. Patterns like dynamic flag construction (e.g.,--"$ACTION"instart-stop-script.sh) and the collection of extra arguments (EXTRA_ARGS) create a potential surface for command injection if the input is not strictly validated. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of web application packages from Virtualmin's official repositories, which involves downloading and executing third-party software on the server.
Recommendations
- AI detected serious security threats
Audit Metadata