pyprland
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill instructs the installation of the 'pyprland' package via pip/pipx from the 'hyprland-community' repository. This source is not within the defined list of trusted organizations, representing a potential supply chain risk.
- [COMMAND_EXECUTION] (HIGH): The skill is designed to execute shell commands (e.g., terminal emulators, volume controllers) defined in a TOML configuration file. This is a primary feature but constitutes a high-risk Indirect Prompt Injection surface.
- Ingestion points: Untrusted data can enter the agent context via the '~/.config/hypr/pyprland.toml' configuration file.
- Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the configuration processing.
- Capability inventory: The skill utilizes 'pypr toggle' and 'exec-once' to trigger subprocess execution of arbitrary commands defined in the config.
- Sanitization: Absent; the skill performs no validation or filtering of the commands provided in the configuration before execution.
Recommendations
- AI detected serious security threats
Audit Metadata