requesthunt

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent or user to install a CLI tool using a command that pipes a remote script to a shell (curl -fsSL https://requesthunt.com/cli | sh). This downloads and executes code directly from the developer's server.
  • [EXTERNAL_DOWNLOADS]: The CLI installation process involves downloading pre-built binaries from GitHub Releases (github.com/ReScienceLab/requesthunt-cli/releases).
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to scrape and process user-generated content from external platforms, which could contain malicious instructions.
  • Ingestion points: SKILL.md (via scrape, search, and list commands) and examples/calendar-app-research.md.
  • Boundary markers: Present; the skill author includes a 'Content Safety' section directing the agent to wrap external feedback in blockquotes.
  • Capability inventory: The skill relies on the requesthunt CLI to perform network operations and local data processing.
  • Sanitization: Absent; the skill relies on the agent's instructions to summarize and quote rather than programmatically filtering the content.
  • [COMMAND_EXECUTION]: The skill executes the requesthunt CLI to manage research tasks, authentication, and configuration settings.
Recommendations
  • HIGH: Downloads and executes remote code from: https://requesthunt.com/cli - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 16, 2026, 12:23 PM
Security Audit — agent-trust-hub — requesthunt