verstak
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
establish-mcp.mdmethod provides instructions to download theverstak-bridge.mjsscript from the vendor's official GitHub repository (github.com/verstak-ai/skills) usingcurlorwget. This script is the core transport layer for connecting the agent to the Verstak knowledge graph. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of the downloaded bridge script using the
noderuntime. This is the primary infrastructure component for the Verstak methodology and is sourced from the vendor's repository. - [COMMAND_EXECUTION]: Various methods within the skill utilize shell commands to interact with system tools, including
gitfor version control,ghfor GitHub API access, andnodefor administrative tasks and subagent coordination. - [PERSISTENCE]: The
align.mdmethod automates the configuration of AI harness settings (such as.claude/settings.json) and the installation of custom plugins (e.g.,.opencode/plugins/verstak.js). These hooks are used to automate 'rituals' like session start procedures and security guards that run in every session within an aligned directory. - [INDIRECT_PROMPT_INJECTION]: The
intake.mdandproduct-roadmap.mdmethods ingest potentially untrusted data from GitHub issues, PRs, and documentation. The skill treats this input as 'shabda' (testimony), requiring it to be explicitly modeled as a claim and verified against the graph or reality before being accepted as fact. - [DYNAMIC_EXECUTION]: The skill implements a delegation model where subagents (reader, worker, reviewer, etc.) are launched dynamically. These subagents are initialized using
node -ecommands to load the bridge script from the user's home directory with specific environment flags. - [SAFE]: The skill includes a proactive 'memory guard' ritual implemented as a shell hook or JavaScript plugin. This guard identifies and blocks the agent from writing to local session-specific memory directories (like
~/.claude/projects/*/memory/), forcing state persistence into the managed knowledge graph or the git repository to prevent unmanaged data leakage.
Audit Metadata