verasic-git-commits
Fail
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README.md file provides installation instructions that download a shell script (setup.sh) from the vendor's GitHub repository.
- [REMOTE_CODE_EXECUTION]: The installation process uses a curl | bash pattern to execute the remote setup.sh script (https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh).
- [COMMAND_EXECUTION]: The skill automates the configuration of git hooks by modifying core.hooksPath and uses git plumbing commands like git commit-tree and git reset --hard to modify repository history. These operations are performed in scripts/wire-hook.sh and references/audit-protocol.md.
- [PROMPT_INJECTION]: The skill implements an audit workflow in references/audit-protocol.md that analyzes git history. Ingestion points: Git commit messages and file paths retrieved via git log. Boundary markers: None implemented for the log output. Capability inventory: File system access and history modification via git commit-tree and git reset --hard. Sanitization: Relies on simple grep pattern matching which does not prevent an agent from following instructions embedded in log data.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh - DO NOT USE without thorough review
Audit Metadata