skills/garrytan/gstack/autoplan/Gen Agent Trust Hub

autoplan

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses the shell eval command to load environment variables from the output of a local binary. It also dynamically reads and executes instructions from other skill files found on the disk (e.g., CEO, design, and engineering reviews) based on the detected project scope.
  • Evidence: eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" in SKILL.md and sections/tasks-aggregator.md.
  • Evidence: Step 3: Load skill files from disk in SKILL.md dynamically reads and follows instructions from multiple relative file paths.
  • [COMMAND_EXECUTION]: The skill frequently executes local binaries and CLI tools to manage its state, perform git operations, and invoke secondary AI models.
  • Evidence: The preamble executes a start script: $_SS="$HOME/.claude/skills/gstack/bin/gstack-skill-start".
  • Evidence: Step 0 executes gh, glab, and git commands for platform detection and branch identification.
  • Evidence: The ceo-phase.md and other phase scripts execute the codex CLI via a bash timeout wrapper.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository (git logs, diffs, design documents, and TODOS.md) and interpolates it into prompts for the primary agent and various sub-agents.
  • Ingestion points: Repository files including CLAUDE.md, TODOS.md, and project-specific design docs.
  • Boundary markers: The skill uses explicit boundary instructions for Codex prompts (e.g., IMPORTANT: Do NOT read or execute any SKILL.md files...) to prevent confusion.
  • Capability inventory: The skill has access to shell execution (Bash), file writing (Write, Edit), and sub-agent invocation (Agent tool).
  • Sanitization: Uses specific instruction markers for external model calls to isolate system instructions from repository data.
  • [DATA_EXFILTRATION]: The skill logs review metrics, telemetry, and durable learnings to a local workspace via specialized logging binaries.
  • Evidence: Telemetry section executes gstack-skill-end with session metadata.
  • Evidence: Completion: Write Review Logs section executes gstack-review-log to record the outcome of the review process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 01:04 PM
Security Audit — agent-trust-hub — autoplan