heretic
Warn
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation and metadata contain numerous references to 'decensoring', 'abliteration', and 'removing refusals'. While intended to describe the modification of target LLMs, these terms match established patterns for prompt injection and jailbreak attempts targeting the AI agent itself.
- [EXTERNAL_DOWNLOADS]: The
scripts/install.shfile downloads the core tool and its dependencies from a non-trusted third-party repository (github.com/p-e-w/heretic) and the PyPI registry. - [REMOTE_CODE_EXECUTION]: The installation process involves fetching and executing code from external sources via
pip installandgit clone. The execution of a shell script (install.sh) to perform these operations on untrusted code constitutes a remote code execution risk. - [COMMAND_EXECUTION]: The
scripts/install.shscript uses theevalcommand to run shell instructions built with environment variables likeREFandUPSTREAM_URL. This is an unsafe practice that could allow for command injection if the environment is compromised.
Audit Metadata