kernel-filesystem-ops
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- Data Exposure & Exfiltration (HIGH): The
read-fileanddownload-dir-zipcommands allow the agent to read any file the VM user has access to, including potential configuration files or credentials. - Privilege Escalation (HIGH): The
set-permissionscommand allows modifying file modes, owners, and groups, which can be used to bypass local access controls or escalate privileges within the VM. - Indirect Prompt Injection (HIGH): This skill has a high vulnerability surface. 1. Ingestion points:
read-filein SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory:write-file,set-permissions, andupload-zipin SKILL.md. 4. Sanitization: Absent. The agent could read a malicious file and be coerced into using its write/permission capabilities to compromise the VM. - Unverifiable Dependencies (MEDIUM): The skill relies on an external CLI tool
kernelwhich is not from a trusted source. - Persistence Mechanisms (MEDIUM): The ability to write to arbitrary paths enables the modification of shell profiles (e.g., .bashrc) to maintain access across sessions.
- Dynamic Execution (MEDIUM): The
upload-zipcommand extracts archives at runtime, which is a potential vector for zip-slip or payload deployment.
Recommendations
- AI detected serious security threats
Audit Metadata