skills/garrytan/gstack/context-save/Gen Agent Trust Hub

context-save

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses a bash preamble that executes upon loading to initialize the session, verify configurations, and check for updates via local gstack binaries.
  • [COMMAND_EXECUTION]: Employs bash commands to collect project state, including git branch information, status, and diffs, which are used to populate the session summary.
  • [DYNAMIC_EXECUTION]: Utilizes eval and source on the output of its internal utilities (gstack-slug, gstack-repo-mode) to configure environment variables and determine project paths.
  • [DATA_EXPOSURE]: Includes an opt-in telemetry system that logs usage data to vendor-controlled utilities. The system is designed with privacy in mind, prompting for consent and excluding sensitive project data.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Gathers data from git status, git diff, git log, and conversation history to build a session summary.
  • Boundary markers: Context is captured into a structured markdown file using a predefined template.
  • Capability inventory: The skill has access to Bash and Write tools.
  • Sanitization: Uses a strict allowlist to sanitize user-provided titles before they are used in file paths and ensures summarized content is handled according to the skill's state-saving purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 05:21 PM
Security Audit — agent-trust-hub — context-save