gstack

SUSPICIOUS: the core repo-review behavior is plausible, and the gstack helpers appear to come from the same publisher, so this is not confirmed malware. However, the skill's footprint is materially broader than pure plan review: it executes many local helper binaries, writes persistent cross-session state, offers transitive skill use, and may forward usage metadata via telemetry, all while processing untrusted repo and web content with Bash access.

SUSPICIOUS. The core git/PR automation matches the stated purpose, but the skill’s footprint is unusually broad: it performs autonomous external actions, chains into another skill, and relies on multiple opaque local gstack binaries including telemetry helpers whose provenance and data flows are not visible. I do not see confirmed malware or overt credential theft, but the unverifiable helper executables plus automatic push/PR/comment behavior make this a high-trust workflow that exceeds low-risk expectations.

SUSPICIOUS. The core git/gh capabilities match a shipping workflow, and the helper tooling appears same-org rather than random third-party code. Risk comes from autonomous external actions, opaque telemetry helpers, and automatic execution of a second skill, making the footprint broader than a simple PR helper but not fundamentally incompatible with its purpose.

SUSPICIOUS: the core plan-review behavior is coherent, and the gstack helper provenance appears same-org, but the skill’s footprint is wider than necessary because it mixes review work with telemetry, dashboard logging, optional external tool handoff, and broad Bash/Write powers. This looks like a high-trust workflow skill rather than outright malware, but it carries medium security risk from execution scope and opaque telemetry behavior.

SUSPICIOUS. The core review behavior matches the stated purpose, but the skill’s footprint is much broader than a simple plan-review tool: it executes numerous opaque local helper binaries, performs telemetry/review logging, writes multiple files under the user home directory, and can edit the active plan file and trigger other tooling. These behaviors are not fundamentally incompatible with a gstack-managed workflow, but they are disproportionate enough to warrant caution and higher trust assumptions than the description suggests.

SUSPICIOUS: the skill mostly aligns with its stated design-audit purpose, and its helper binaries appear to come from the same gstack project. However, it mixes visual QA with telemetry helpers, uses remote installer execution for Bun, and lets untrusted webpage content influence code edits and git commits, making the overall risk medium rather than benign.

SUSPICIOUS. The core review capabilities fit the stated purpose, and the GitHub/Codex tooling appears official. Main concerns are disproportionate workflow breadth: extensive local helper execution from user-writable home paths, persistent telemetry/state logging, optional forwarding of repo diffs to Codex, and some autonomous code/test edits and GitHub replies. This looks more like a heavy gstack platform wrapper than a minimal review skill; not clearly malicious, but riskier than a normal read-only PR review skill.

SUSPICIOUS. The skill's review/editing behavior broadly matches its stated purpose, but its footprint is enlarged by transitive skill loading, automatic file modification, and especially reliance on opaque home-directory gstack executables for telemetry and review logging. With no verifiable provenance for those helper binaries in the provided material, the install/execution trust model is too weak to treat as benign.

SUSPICIOUS: the core deploy-detection behavior is coherent, but the skill is over-scoped. It bundles unrelated gstack upgrade logic, telemetry collection, local analytics writes, browser prompting, and execution of local same-org helper binaries. Provenance appears same-org and not overtly malicious, but mutable local scripts plus third-party telemetry routing to Supabase make the footprint disproportionate to a simple deployment-setup skill.

The core deployment-configuration behavior is coherent and mostly legitimate, and the helper binaries appear to come from the same gstack project. However, the skill’s footprint is broader than necessary: it performs telemetry/session logging, upgrade checks, contributor reporting, and external browser prompts that are not essential to setting up deployment. This makes it suspicious rather than malicious, with medium security risk driven by disproportionate telemetry and delegated local binary execution.

This code fragment is best characterized as a high-privilege browser inspection/debugging tool that can execute arbitrary JavaScript in the page context (from user input and from local file contents) and can return highly sensitive browser artifacts (notably cookies in full and web storage with heuristic redaction). If any untrusted party can influence the command arguments or reach this interface, the risk is high due to arbitrary code execution and potential session/token data exposure. No explicit network exfiltration is shown in the snippet, but returned data can still enable exfiltration via the caller/channel that invokes these commands.

No definitive evidence of malware/backdoor behavior is visible in this module. However, the code performs notable security-sensitive operations: it executes an external CLI through a shell pipeline using `spawnSync('sh','-c', ...)` and passes `--dangerously-skip-permissions`, creates executable shim scripts on disk, and persists detailed evaluation transcripts/tool inputs and diagnostic JSON to local storage. These behaviors warrant careful scrutiny of the invoked CLI/tooling and the EvalCollector/transcript contents for privacy and operational safety.

No direct evidence of malicious code (no obfuscation, no eval/dynamic execution, no network exfiltration, no persistence). However, the module runs an external, potentially powerful executor (`codex`) with user-controlled `prompt` and `sandbox`, and it copies host `~/.codex` configuration into the temporary environment (reducing isolation). If `skillDir` or `prompt` are untrusted, this can lead to command/tool execution by `codex` and potential leakage via stderr logging of tool commands/messages.

This module does not show explicit malicious code patterns (no eval/dynamic execution, no suspicious obfuscation, and no direct exfiltration/network calls in the snippet). However, it implements highly sensitive functionality: it imports decrypted cookies from local browser storage into a Playwright context and can clear cookies by domain, driven by caller-supplied browser/domains, while exposing local environment data (installed browsers/domains) without visible authentication/authorization. The dynamic CORS origin based on request url.port further increases exposure if the service is reachable by untrusted local code. Treat this as a high-impact security design risk rather than evidence of overt malware in this file.

This file is best characterized as a compatibility shim that (1) forwards incoming HTTP requests via a user-supplied fetch after reconstructing a target URL from client-controlled paths and headers, and (2) exposes OS command execution wrappers globally through globalThis.Bun.spawn/spawnSync. While there are no direct signs of intentional malware in this snippet (no hardcoded exfiltration targets, persistence, or obfuscation), it materially increases the potential impact of any upstream misuse because it provides arbitrary command execution and proxy-like request forwarding without input validation or allowlists. It also leaks exception messages to HTTP clients.

The snippet contains a high-impact authorization failure pattern: an endpoint promotes an arbitrary user to role='admin' based solely on params[:id], returning success without any visible authorization checks. The show action appears truncated but includes a raw SQL where-clause pattern that could indicate SQL injection depending on how params are used in the complete code. No clear indicators of supply-chain malware (payload/backdoor/network theft) are present in this fragment, but the privilege escalation behavior alone represents a serious security risk if the route is reachable by untrusted users.