supsub-deepread
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the necessary CLI tool by piping a remote shell script from the vendor's repository into the bash interpreter.
- Evidence:
curl -fsSL https://raw.githubusercontent.com/SupSub-AI/supsub-cli/master/scripts/install.sh | bashinSKILL.md. - [EXTERNAL_DOWNLOADS]: The tool can be installed via the NPM registry (@supsub/cli) or directly from the vendor's GitHub repository.
- [COMMAND_EXECUTION]: The skill uses various shell commands to execute the
supsubCLI, managing authentication, article metadata, and local analysis caches. - [PROMPT_INJECTION]: The instructions include specific safety constraints to manage agent autonomy.
- Guardrails: The agent must confirm quota availability before execution and verify article IDs against the current context to prevent errors.
- Indirect Injection Surface: The skill processes content from external websites and social media platforms. While it lacks explicit boundary markers for these inputs, it mandates the use of structured JSON output for analysis processing.
Audit Metadata