Build Custom Linux ISO's and Deployments

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but it needs review because its examples and VM controls could create vulnerable or destructive infrastructure if used as written.

Review this skill before installing. Use it only with a trusted OpenFactory account and endpoint, replace all example passwords with SSH keys or unique secrets, avoid copying privileged admin examples unchanged, and require explicit user confirmation before deleting VM disks, force-stopping VMs, or building images that auto-deploy services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:81

Finding

Predictable Default Passwords Assigned to Privileged Accounts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81 and 160
Vulnerability Type: Hardcoded weak credentials in example ISO recipes
Risk Level: High

Vulnerable Code

At line 81:

json

{"username": "admin", "password": "changeme", "groups": ["sudo"]}

At line 160:

json

"users": [{"username": "admin", "password": "admin", "groups": ["sudo", "docker"]}]

Technical Analysis

The documented recipe schema and build example assign predictable plaintext passwords to an admin account. The account is also placed in the sudo group and, in one example, the docker group.

Users or AI agents may submit these examples to create_build without replacing the example credentials. The resulting ISO could therefore contain publicly known credentials. Membership in sudo may permit root-level command execution, depending on the generated image's sudo policy. Docker group access is also commonly equivalent to root access because a user can start a privileged container or mount the host filesystem.

The weakness is especially consequential when the image enables SSH or is deployed to a VM with a reachable login interface.

Attack Path

1. A user or agent copies one of the documented recipes without changing its password.
2. OpenFactory builds an ISO containing the admin account and predictable password.
3. The ISO is deployed to a VM or physical system with SSH, VNC, console, or another login surface accessible to an attacker.
4. The attacker authenticates using admin/admin or admin/changeme.
5. The attacker invokes sudo if allowed by policy, or abuses Docker group membership by launching a privileged container or mounting the host filesystem.
6. The attacker gains administrative control over the deployed system and its accessible data or services.

Impact Assessment

Successful exploitation could provide access to the generated operating-system instance. Where sudo ...[truncated 498 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all literal passwords from the recipe schema and examples.
• Prefer SSH-key-only authentication and disable password-based SSH login by default.
• Accept password hashes rather than plaintext passwords when password authentication is unavoidable.
• Generate unique, cryptographically secure initial credentials for each build and deliver them through a protected secret-management channel.
• Require password rotation on first login and prevent initial credentials from being embedded permanently in an ISO.
• Add recipe validation that rejects common, default, blank, or breached passwords such as admin and changeme.
• Warn users before building any recipe containing plaintext credentials.
• Apply least privilege: do not add accounts to sudo or docker unless explicitly required.
• Document that Docker group membership is generally equivalent to root access.
• Add automated tests that fail documentation and release checks when example recipes contain predictable credentials.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

| `create_build(recipe)` | Create a new build from a recipe (see Recipe Schema below). |
| `retry_build(build_id)` | Retry a failed build with the same recipe. |
| `get_iso_download_url(build_id)` | Get a download URL for the completed ISO. |
| `deploy_from_git(repo_url, base_image?, branch?)` | Build an ISO that auto-deploys a git repo as a service. |

### Recipes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

| `create_build(recipe)` | Create a new build from a recipe (see Recipe Schema below). |
| `retry_build(build_id)` | Retry a failed build with the same recipe. |
| `get_iso_download_url(build_id)` | Get a download URL for the completed ISO. |
| `deploy_from_git(repo_url, base_image?, branch?)` | Build an ISO that auto-deploys a git repo as a service. |

### Recipes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown documents delete_vm(vm_name) as deleting a VM and its disk, which is a destructive and potentially irreversible action. The file provides no warning, confirmation guidance, or cautionary note about data loss anywhere near the tool description or workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The stop_vm(vm_name, force?) entry notes that force=true performs an immediate power-off, which can risk data loss or filesystem corruption. The skill description does not include any caution or user-facing warning about those consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.