gpon-sfp-onu-stick-expert
Fail
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains a hardcoded management password (
7sp!lwUBz1) for theONTUSERaccount used to access the FS GPON SFP ONU sticks. This credential provides administrative access to the hardware's management interface. - [EXTERNAL_DOWNLOADS]: The skill references external URLs for configuration guides and firmware, including the official vendor site (fs.com) and a community-maintained wiki (hack-gpon.org).
- [COMMAND_EXECUTION]: Detailed instructions are provided for executing sensitive administrative commands on the ONU sticks and OLT infrastructure, such as modifying U-Boot environment variables via
fw_setenv, performing raw I2C register writes viasfp_i2c, and usingsedto alter system configuration files for hardware emulation. - [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to process and act upon data retrieved from hardware devices.
- Ingestion points: Hardware output from
sfp_i2cand OLT discovery commands (show gpon onu) processed by the agent. - Boundary markers: Absent; no delimiters or safety instructions are defined to separate hardware-sourced data from the agent's internal logic.
- Capability inventory: Use of SSH and OLT management CLI tools for hardware configuration and service setup.
- Sanitization: Absent; no mention of validating or escaping data returned from the devices.
Recommendations
- AI detected serious security threats
Audit Metadata