skills/garrytan/gstack/pair-agent/Gen Agent Trust Hub

pair-agent

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the Bun runtime installation script from the official bun.sh domain. This is a well-known service, and the skill includes a SHA-256 checksum verification step to ensure the downloaded script has not been tampered with before execution.
  • [REMOTE_CODE_EXECUTION]: Executes the verified Bun installer to set up the execution environment for the browser tools. This step is only initiated if the user provides consent during the setup phase.
  • [COMMAND_EXECUTION]: Employs shell commands to manage environment variables, project metadata (such as CLAUDE.md routing rules), and session persistence. It manages ngrok for exposing the local browser server to remote agents and writes session tokens to specific agent configuration directories. Significant actions are transparently presented to the user via the AskUserQuestion tool for approval.
  • [DATA_EXFILTRATION]: Features an optional telemetry system that logs anonymous usage statistics, including skill duration and outcomes. The user is prompted to opt-in and choose their desired level of privacy (community, anonymous, or off) upon the skill's first run.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 08:08 PM