verasic-git-commits-convention
Fail
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README.md file contains references to an installation script hosted on the well-known raw.githubusercontent.com domain.
- [REMOTE_CODE_EXECUTION]: The installation process suggests piping a remote script from the author's GitHub repository directly into the shell for execution.
- [COMMAND_EXECUTION]: The scripts/wire-hook.sh script executes commands to modify the repository-local git config core.hooksPath, establishing a persistent commit-msg hook. The references/audit-protocol.md document provides shell procedures for rewriting repository history using git commit-tree.
- [PROMPT_INJECTION]: The audit protocol in references/audit-protocol.md ingests commit messages from repository history to evaluate them against style rules. This constitutes an indirect prompt injection surface where unverified data is processed alongside capabilities for git history manipulation and shell execution.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh - DO NOT USE without thorough review
Audit Metadata