Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Content
## Install ```bash sudo dnf install xclip ```
- Confidence
- 70% confidence
- Finding
- Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Security audit
Clipboard
Security checks for vulnerabilities and agentic risk
Overview
This clipboard skill does what it says: it teaches the agent to use xclip for text clipboard copy and paste, with only a normal package-install note as elevated access.
Install this only if you are comfortable allowing an agent to read and write your text clipboard when you invoke the skill. Clipboard contents and copied file contents can contain sensitive data, so review what is being copied or pasted; the sudo command should only be used if you trust installing xclip from your configured dnf repositories.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
Static analysis
No suspicious patterns detected.