agent-session-search
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The configuration guide recommends installing the underlying binary using a shell one-liner that pipes a remote script from an untrusted GitHub repository directly into bash (
curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_session_search/main/install.sh | bash). This pattern allows arbitrary remote execution without verification. - [EXTERNAL_DOWNLOADS]: The skill requires downloading external setup files and scripts from unverified repositories outside the trusted scope, and notes that it automatically downloads a ~23MB MiniLM model file from FastEmbed repositories during the first execution of semantic search mode.
- [COMMAND_EXECUTION]: The skill relies extensively on executing shell commands via the external
casstool for indexing local directories, performing local history lookups, and triggering SSH/rsync automated environment discovery viacass sources setupwhich accesses~/.ssh/configto coordinate remote operations.
Recommendations
- AI detected serious security threats
Audit Metadata