nano
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various local scripts and binaries to manage the planning lifecycle.
- Evidence: Calls to scripts in
~/.claude/skills/nanostack/bin/includingsession.sh,resolve.sh,save-artifact.sh,skill-preamble.sh, andskill-finalize.sh. - [DATA_EXFILTRATION]: Contains a telemetry mechanism that executes initialization and finalization scripts, which are designed to track skill usage.
- Evidence: Execution of
skill-preamble.shandskill-finalize.shin the preamble and finalize sections of the SKILL.md. Note: The skill provides an opt-out via theNANOSTACK_NO_TELEMETRYenvironment variable. - [INDIRECT_PROMPT_INJECTION]: The skill resolves context by loading "upstream artifacts" and "past solutions" to inform the current plan's scope, risks, and constraints.
- Ingestion points: JSON output from
resolve.sh, historicalthinkartifacts, and module briefs (diarizations) located in.nanostack/know-how/diarizations/. - Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the model when processing these ingested documents.
- Capability inventory: Shell execution (local nanostack scripts), git history access, and the ability to trigger subsequent skills in the pipeline (
review,security,qa,ship). - Sanitization: No validation or sanitization process is described for the content extracted from artifacts or diarizations.
Audit Metadata