provision-nixos-server
Fail
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- EXTERNAL_DOWNLOADS (HIGH): The skill downloads SSH public keys from an individual GitHub user account and pipes them directly into the root user's authorized_keys file. This grants persistent remote access based on an unverified external source.
- Evidence:
curl -s https://github.com/fred-drake.keys > ~/.ssh/authorized_keysinSKILL.md. - CREDENTIALS_UNSAFE (HIGH): Configuration templates contain multiple hardcoded SSH public keys. Any server provisioned using these templates will automatically grant access to the owners of these specific keys.
- Evidence:
users.users.default.openssh.authorizedKeys.keysinmodules/nixos/host/<hostname>/configuration.nixcontains three hardcoded keys. - DATA_EXFILTRATION (HIGH): The workflow includes a step that copies a private infrastructure key (
id_infrastructure) from the local machine to the newly provisioned remote host via SCP, exposing sensitive local credentials. - Evidence:
scp ~/.ssh/id_infrastructure default@<NEW_IP>:~/id_infrastructureinSKILL.md. - COMMAND_EXECUTION (MEDIUM): The skill frequently executes shell commands on the remote Proxmox host and within containers using
sshandpct exec, which provides a high degree of control over the target system. - Evidence: Usage of
ssh $PROXMOX_SERVER "pct create..."andssh $PROXMOX_SERVER "pct exec..."inSKILL.md. - PROMPT_INJECTION (LOW): The skill is susceptible to indirect prompt injection because it interpolates user-provided variables (hostname, IP, container ID) directly into shell commands without sanitization or boundary markers.
- Ingestion points:
SKILL.md(Step 1: Gather Requirements). - Boundary markers: Absent.
- Capability inventory:
ssh,scp,colmena,pctexecution, and file system modifications. - Sanitization: Absent.
Recommendations
- AI detected serious security threats
Audit Metadata