paired-probe

Warn

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/paired-probe.sh uses eval to execute commands passed via the --present, --absent, and --measure arguments.
  • Evidence in scripts/paired-probe.sh: out=$(eval "$1" 2>&1); rc=$? within the run() function.
  • Risk: If an agent or user interpolates untrusted data into these arguments, it will result in arbitrary shell command execution.
  • [DYNAMIC_EXECUTION]: The skill generates and executes shell commands at runtime based on the arguments provided to the paired-probe.sh script.
  • This pattern is inherent to the tool's purpose as a meta-diagnostic utility but represents a significant attack surface.
  • [COMMAND_EXECUTION]: The script explicitly opts out of shell strict mode (set -e) to prevent the script from exiting when one of the tested commands fails, as failing is a desired outcome for comparison.
  • Evidence in scripts/paired-probe.sh: set -uo pipefail (notably excluding -e).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 6, 2026, 09:03 AM
Security Audit — agent-trust-hub — paired-probe