verasic-deep-research

Fail

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The README documentation includes a command to download and execute an installation script (setup.sh) from the author's official GitHub repository using a piped-to-shell pattern. This is a vendor-provided deployment mechanism from a well-known service.
  • [EXTERNAL_DOWNLOADS]: The skill uses external tools and scripts hosted on GitHub for installation and orchestration of research tasks, which is standard for developer-oriented agent extensions.
  • [COMMAND_EXECUTION]: The package contains several local shell scripts in the scripts/ directory (e.g., test-exhaustive.sh) used for validating the research protocol and performing regression testing of the orchestrator's logic.
  • [PROMPT_INJECTION]: The skill processes untrusted content from the web as part of its research functionality, presenting a surface for indirect prompt injection.
  • Ingestion points: External data enters the context when 'Hunter' and 'Practitioner' subagent roles perform web searches and HTTP fetches of external URLs.
  • Boundary markers: The protocol utilizes a 'source-boundary' configuration and mandatory verification via the 'verify-before-cite' ledger to restrict and validate external content.
  • Capability inventory: The skill is capable of spawning subagents via the 'Task' tool, executing network requests, and writing research files to the local filesystem.
  • Sanitization: The 'two-key' rule ensures that citations are backed by specific, verified excerpts from the source, providing a layer of validation against malformed or misleading source content.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 25, 2026, 12:48 PM
Security Audit — agent-trust-hub — verasic-deep-research