autoplan
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses the shell
evalcommand to load environment variables from the output of a local binary. It also dynamically reads and executes instructions from other skill files found on the disk (e.g., CEO, design, and engineering reviews) based on the detected project scope. - Evidence:
eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)"inSKILL.mdandsections/tasks-aggregator.md. - Evidence:
Step 3: Load skill files from diskinSKILL.mddynamically reads and follows instructions from multiple relative file paths. - [COMMAND_EXECUTION]: The skill frequently executes local binaries and CLI tools to manage its state, perform git operations, and invoke secondary AI models.
- Evidence: The preamble executes a start script:
$_SS="$HOME/.claude/skills/gstack/bin/gstack-skill-start". - Evidence:
Step 0executesgh,glab, andgitcommands for platform detection and branch identification. - Evidence: The
ceo-phase.mdand other phase scripts execute thecodexCLI via a bash timeout wrapper. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository (git logs, diffs, design documents, and
TODOS.md) and interpolates it into prompts for the primary agent and various sub-agents. - Ingestion points: Repository files including
CLAUDE.md,TODOS.md, and project-specific design docs. - Boundary markers: The skill uses explicit boundary instructions for Codex prompts (e.g.,
IMPORTANT: Do NOT read or execute any SKILL.md files...) to prevent confusion. - Capability inventory: The skill has access to shell execution (
Bash), file writing (Write,Edit), and sub-agent invocation (Agenttool). - Sanitization: Uses specific instruction markers for external model calls to isolate system instructions from repository data.
- [DATA_EXFILTRATION]: The skill logs review metrics, telemetry, and durable learnings to a local workspace via specialized logging binaries.
- Evidence:
Telemetrysection executesgstack-skill-endwith session metadata. - Evidence:
Completion: Write Review Logssection executesgstack-review-logto record the outcome of the review process.
Audit Metadata