plan-tune
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local scripts and binaries located in
~/.claude/skills/gstack/bin/for tasks including configuration retrieval, update checking, and telemetry logging. It usesevalandsourceto process shell output from these utilities and employsbun -eto execute inline JavaScript for JSON data manipulation and file updates. Additionally, it uses theopencommand to provide access to external documentation. - [DATA_EXFILTRATION]: The skill includes logic to collect usage telemetry (e.g., skill name, execution duration, and outcome) and send it to an external endpoint, which is presented as an opt-in feature for the user. It also facilitates synchronizing project artifacts to a remote GitHub repository.
- [EXTERNAL_DOWNLOADS]: The skill performs version checks by executing a local update-check script that communicates with the vendor's infrastructure to determine if a newer version is available.
Audit Metadata