plan-design-review
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs multiple shell operations for repository detection, CLI authentication checks, and configuration management using git and local gstack binaries. Evidence:
git remote,gh auth status,glab auth status,~/.claude/skills/gstack/bin/gstack-config,~/.claude/skills/gstack/bin/gstack-team-init. - [COMMAND_EXECUTION]: The skill uses
evalto execute the output of a local binary helper (gstack-slug) to set environment variables. - [PROMPT_INJECTION]: The skill ingests user-provided plan files and git history to perform design reviews, creating a surface for indirect prompt injection. Ingestion points: Plan files, branch diffs, and git logs. Boundary markers: Absent. Capability inventory: File reading (Read, Glob, Grep), shell execution (git, gstack binaries), and subagent dispatch via the Agent tool. Sanitization: No explicit sanitization or escaping is performed on the ingested plan text.
- [DATA_EXFILTRATION]: Repository metadata, including remote URLs and pull request details, is accessed to establish execution context and determine target platforms. Evidence:
git remote get-url origin,gh pr view --json baseRefName,glab mr view -F json.
Audit Metadata