gpon-sfp-onu-stick-expert

Fail

Audited by Gen Agent Trust Hub on Apr 20, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill contains a hardcoded management password (7sp!lwUBz1) for the ONTUSER account used to access the FS GPON SFP ONU sticks. This credential provides administrative access to the hardware's management interface.
  • [EXTERNAL_DOWNLOADS]: The skill references external URLs for configuration guides and firmware, including the official vendor site (fs.com) and a community-maintained wiki (hack-gpon.org).
  • [COMMAND_EXECUTION]: Detailed instructions are provided for executing sensitive administrative commands on the ONU sticks and OLT infrastructure, such as modifying U-Boot environment variables via fw_setenv, performing raw I2C register writes via sfp_i2c, and using sed to alter system configuration files for hardware emulation.
  • [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to process and act upon data retrieved from hardware devices.
  • Ingestion points: Hardware output from sfp_i2c and OLT discovery commands (show gpon onu) processed by the agent.
  • Boundary markers: Absent; no delimiters or safety instructions are defined to separate hardware-sourced data from the agent's internal logic.
  • Capability inventory: Use of SSH and OLT management CLI tools for hardware configuration and service setup.
  • Sanitization: Absent; no mention of validating or escaping data returned from the devices.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 20, 2026, 11:27 AM
Security Audit — agent-trust-hub — gpon-sfp-onu-stick-expert