requesthunt
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent or user to install a CLI tool using a command that pipes a remote script to a shell (
curl -fsSL https://requesthunt.com/cli | sh). This downloads and executes code directly from the developer's server. - [EXTERNAL_DOWNLOADS]: The CLI installation process involves downloading pre-built binaries from GitHub Releases (
github.com/ReScienceLab/requesthunt-cli/releases). - [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to scrape and process user-generated content from external platforms, which could contain malicious instructions.
- Ingestion points:
SKILL.md(viascrape,search, andlistcommands) andexamples/calendar-app-research.md. - Boundary markers: Present; the skill author includes a 'Content Safety' section directing the agent to wrap external feedback in blockquotes.
- Capability inventory: The skill relies on the
requesthuntCLI to perform network operations and local data processing. - Sanitization: Absent; the skill relies on the agent's instructions to summarize and quote rather than programmatically filtering the content.
- [COMMAND_EXECUTION]: The skill executes the
requesthuntCLI to manage research tasks, authentication, and configuration settings.
Recommendations
- HIGH: Downloads and executes remote code from: https://requesthunt.com/cli - DO NOT USE without thorough review
Audit Metadata