goodverify
Fail
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains an
installsubcommand that downloads and executes shell scripts from the author's official GitHub repository (agoodway/goodverify_cli) using piped execution (sh and iex).\n- [COMMAND_EXECUTION]: The skill facilitates the execution of thegoodverifybinary for all primary functions, including configuration, verification, and batch processing.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted user data and passing it as command-line arguments.\n - Ingestion points: User-provided email addresses, phone numbers, physical addresses, and file paths processed in
SKILL.md.\n - Boundary markers: The instructions lack delimiters or explicit directives for the agent to treat user data as non-executable text.\n
- Capability inventory: The skill allows the agent to execute arbitrary subcommands via the
goodverifybinary, which can interact with the network and local file system.\n - Sanitization: There are no instructions for sanitizing or escaping user input before it is interpolated into shell commands.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/agoodway/goodverify_cli/main/install.sh - DO NOT USE without thorough review
Audit Metadata