gstack

SUSPICIOUS. The core browsing capability matches the stated QA purpose, and the setup sources are largely same-org or official. But the skill’s footprint is wider than a browser helper: it includes telemetry, artifact sync, config mutation, CLAUDE.md routing injection, and git commits through opaque local binaries, which raises medium trust and scope concerns even without clear malicious intent.

SUSPICIOUS. The core benchmark function is coherent and mostly routes data to expected model providers using same-org tooling, so this is not confirmed malware. But the skill's actual footprint is broader than its stated purpose: it reads credential-related files, runs multiple bundled binaries, writes analytics/state, and the shared preamble can modify repo/config artifacts unrelated to benchmarking. Overall this looks like a legitimate but over-scoped skill framework with medium security risk.

SUSPICIOUS: the main browser-QA capability is legitimate and mostly aligned, but the skill’s footprint is broader than its stated purpose. Official Bun install evidence reduces supply-chain concern, yet opaque helper binaries, optional telemetry/artifact sync, cookie handling, repo edits/commits, and transitive invocation of many other skills create medium security risk.

SUSPICIOUS. The core benchmarking behavior is plausible, and the only explicit installer shown is from an official Bun source with checksum verification. But the skill's actual footprint is much broader than performance testing: it can modify project files, commit changes, manage upgrades, log telemetry, and participate in artifact sync. That overreach and partially opaque outbound binaries make it medium risk, though not confirmed malware.

This module primarily performs structured JSON validation, bounded deduplication, and local append-only logging. It does not directly show malware behaviors such as credential theft, network exfiltration, or destructive operations. However, it contains a significant supply-chain/injection risk: it uses eval on the output of a local helper script to derive runtime variables (affecting the filesystem write path and potentially enabling command execution if helper output is compromised or influenced). It also spawns an asynchronous derivation script whose behavior is not visible here, increasing overall risk surface. Review and harden the eval usage and verify the integrity and output constraints of the helper scripts involved.

This code is an intentional Playwright stealth/fingerprinting evasion module. It injects scripts that override and forge automation-detection-relevant browser APIs (navigator.webdriver, WebGL getParameter, navigator.plugins, window.chrome shims, mediaDevices enumeration) and removes automation marker properties ('cdc_*'). No direct malware behaviors (exfiltration, credential theft, remote execution) are evident in the provided fragment, but the primary security concern is enabling deceptive automated browsing that can violate site policies or facilitate abuse. Further risk depends on how the package is used (targets, authentication flows, and consent).

No overt malicious behavior is evident in the provided module, but it is security-sensitive because it executes a local TypeScript script via Bun using a path that can be influenced by caller-provided options and filesystem probing, and it kills a process based on a persisted on-disk PID record without cryptographic integrity checks. The main supply-chain/runtime risk depends on whether upstream callers or attackers can control opts.scriptPath/metaDir/execPath-derived discovery or tamper with the stateDir/agent record file. If inputs and state files are strictly trusted and protected, risk is lower; otherwise it could enable arbitrary local code execution or denial of service.

No direct malicious indicators (e.g., credential theft, exfiltration endpoints, backdoors, or obfuscation) are present in this snippet. However, the module performs a meaningful supply-chain-sensitive action: it can `git pull` remote updates and then execute `./setup -q` from the updated revision, running silently in the background and only limited by throttling and a local lock. The security posture therefore depends heavily on the trustworthiness and integrity of the git remote/transport and the safety of the repository’s `setup` script.

Overall, this appears to be a benign local timeline reader/formatter with no network exfiltration or typical malware behaviors in the provided fragment. The primary supply-chain security concern is the use of eval on the output of an external helper (gstack-slug), which can turn helper compromise or attacker-influenced output into arbitrary code execution. Additionally, silent error suppression and lenient parsing reduce observability if something goes wrong.

No direct indicators of covert malware (e.g., no exfiltration, no obfuscation, no remote payload execution) are present in this snippet. However, it intentionally reuses the user’s real Chrome session state (Default profile and Local State) while enabling CDP—a powerful control interface—against that real data context. This materially increases local attack impact if an attacker can connect to the CDP port or run untrusted code on the same host. Operationally, it also force-terminates Chrome if shutdown fails.

No direct indicators of overt malware are present in this fragment (no credential access, cryptomining, reverse shell, or explicit network calls). The dominant supply-chain/security concern is dynamic shell-code execution via eval of gstack-slug output, which could become command execution if the helper is compromised or its output can be influenced. A secondary risk is the asynchronous enqueue step, which may cause off-host sync/exposure depending on gstack-brain-enqueue’s implementation; behavior is not visible here. The overall risk is therefore moderate, primarily due to eval and unreviewed downstream sync behavior.

No direct exfiltration, credential theft, persistence, or overt malware behavior is visible in this fragment. However, the module contains a significant supply-chain execution risk: eval executes dynamically produced shell code from gstack-slug, and the resulting variables determine filesystem write locations and the argument passed to the enqueue helper. Combined with the unknown behavior of the enqueue helper (potentially involving cross-machine sync), this warrants security review of gstack-slug and gstack-brain-enqueue for trust boundaries and injection/path-manipulation protections. Malware likelihood from this snippet alone appears low-to-moderate, but security risk is moderate due to eval and suppressed background behavior.