office-hours
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Bun runtime installer from 'https://bun.sh/install' if it's not present on the system. It uses a hardcoded SHA-256 hash ('bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd') to verify the script's integrity before execution.
- [REMOTE_CODE_EXECUTION]: The skill executes the downloaded Bun installation script via bash after successful integrity verification.
- [COMMAND_EXECUTION]: The skill makes extensive use of local shell commands for environment discovery (git log, git diff, ls) and for managing its own state via the 'gstack-config' and 'gstack-slug' binaries located in the user's home directory or project folders.
- [REMOTE_CODE_EXECUTION]: The skill optionally utilizes 'codex' and Claude subagents to provide independent 'second opinions' on design premises and implementation approaches.
Audit Metadata