ship

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses the Bash tool to perform repository operations, execute local test suites, and run a variety of specialized helper binaries located in ~/.claude/skills/gstack/bin/ (e.g., gstack-review-read, gstack-slug, gstack-review-log).
  • [COMMAND_EXECUTION]: Employs eval and source <(...) patterns to dynamically load shell environment configuration from the output of local scripts like gstack-diff-scope and gstack-slug.
  • [COMMAND_EXECUTION]: Interfaces with external repository hosting platforms using standard command-line interfaces such as gh (GitHub CLI) and glab (GitLab CLI) for actions like viewing PRs, creating issues, and managing merge requests.
  • [EXTERNAL_DOWNLOADS]: During the optional test framework bootstrap phase, the skill may invoke package managers (e.g., npm, gem, pip, cargo) to install testing dependencies from official registries based on the detected project runtime.
  • [COMMAND_EXECUTION]: Integrates with the codex CLI for performing external code and design reviews, including the use of codex exec and codex review with reasoning-effort configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 08:50 AM
Security Audit — agent-trust-hub — ship