gstack
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill setup script fetches the Bun runtime installer from
https://bun.sh/installand executes it usingbash. This is a standard installation method for the runtime and utilizes a well-known service endpoint. - [EXTERNAL_DOWNLOADS]: The skill clones the
gbrainrepository from GitHub and downloads necessary Node.js dependencies during its setup and update phases. These operations target legitimate project repositories and established package registries. - [COMMAND_EXECUTION]: The framework frequently executes system commands to manage project metadata, git history, and state. It includes a configuration utility that modifies the AI agent's internal settings (e.g.,
~/.claude/settings.json) to install hooks for session lifecycle management and auto-updates. - [SAFE]: The skill implements an opt-in telemetry system that transmits anonymized usage data to a backend service for project metrics. The system provides clear transparency, allows users to disable tracking via configuration, and sanitizes data to prevent the transmission of project secrets or personal information.
Audit Metadata