skills/garagon/nanostack/nano/Gen Agent Trust Hub

nano

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various local scripts and binaries to manage the planning lifecycle.
  • Evidence: Calls to scripts in ~/.claude/skills/nanostack/bin/ including session.sh, resolve.sh, save-artifact.sh, skill-preamble.sh, and skill-finalize.sh.
  • [DATA_EXFILTRATION]: Contains a telemetry mechanism that executes initialization and finalization scripts, which are designed to track skill usage.
  • Evidence: Execution of skill-preamble.sh and skill-finalize.sh in the preamble and finalize sections of the SKILL.md. Note: The skill provides an opt-out via the NANOSTACK_NO_TELEMETRY environment variable.
  • [INDIRECT_PROMPT_INJECTION]: The skill resolves context by loading "upstream artifacts" and "past solutions" to inform the current plan's scope, risks, and constraints.
  • Ingestion points: JSON output from resolve.sh, historical think artifacts, and module briefs (diarizations) located in .nanostack/know-how/diarizations/.
  • Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the model when processing these ingested documents.
  • Capability inventory: Shell execution (local nanostack scripts), git history access, and the ability to trigger subsequent skills in the pipeline (review, security, qa, ship).
  • Sanitization: No validation or sanitization process is described for the content extracted from artifacts or diarizations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 11:56 PM
Security Audit — agent-trust-hub — nano