ss-cli-deploy
Warn
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/deploy.shconstructs a shell command by interpolating the$SERVICE_DIRand${EXTRA_ARGS[*]}variables directly into abash -ccommand string. - File:
scripts/deploy.sh - Evidence:
ss-cli run --map-file "$MAP_FILE" -- bash -c "cd '$SERVICE_DIR' && docker-compose pull && docker-compose up -d ${EXTRA_ARGS[*]:-}" - Risk: This pattern allows for shell command injection. If an attacker can influence the directory name or the extra arguments provided to the skill, they can execute arbitrary commands on the underlying system by using shell metacharacters (e.g.,
;,&&,|). - [EXTERNAL_DOWNLOADS]: The skill executes
docker-compose pullto download Docker images from external registries. This is a standard operation for the skill's intended deployment purpose.
Audit Metadata