implementing-ebpf-security-monitoring

Fail

Audited by Gen Agent Trust Hub on Apr 20, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The management script scripts/agent.py interacts with system utilities such as kubectl, helm, uname, and tetra using the subprocess module to deploy Tetragon and manage security policies.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download the Tetragon binary from its official GitHub repository (github.com/cilium/tetragon). This is a well-known and trusted source for cloud-native security tooling.
  • [COMMAND_EXECUTION]: The skill requires elevated privileges (sudo and kernel capabilities like CAP_BPF) to install the Tetragon daemon and load eBPF programs, which is required for kernel-level monitoring functionality.
  • [SAFE]: The malicious URL https://malicious.example.com/payload identified by automated scanners is used as a placeholder within a documentation code block to demonstrate a simulated detection event; it is not processed or executed by the skill's code.
  • [COMMAND_EXECUTION]: The scripts/agent.py script includes an action to list and apply TracingPolicy CRDs using kubectl, which is standard behavior for managing Kubernetes security resources.
Recommendations
  • CRITICAL: 1 infected file(s) detected - DO NOT USE
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Apr 20, 2026, 11:33 PM